# D3fend Deceive

> Guides cybersecurity deception operations using MITRE D3FEND—honeynets, decoy objects, decoy personas, and decoy credentials. Covers honeypot deployment, decoy file planting, credential baiting, and deception environment design. Use when deploying honeypots, planting decoy data, baiting credentials, or designing deception programs—not for detection (d3fend-detect), hardening (d3fend-harden), or isolation (d3fend-isolate).

- Skill: `daemon-blockint-tech/d3fend-deceive` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add daemon-blockint-tech/d3fend-deceive`
- Raw SKILL.md: https://api.skillmd.com/api/skills/daemon-blockint-tech/d3fend-deceive/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: daemon-blockint-tech (https://skillmd.com/u/daemon-blockint-tech)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/daemon-blockint-tech/d3fend-deceive

---


# D3FEND — Deceive

## When to Use

- Deploying honeynets (connected, integrated, standalone)
- Planting decoy objects (files, network resources, personas)
- Distributing decoy credentials and session tokens
- Publishing decoy information (fake releases, personas)
- Designing deception programs and adversary engagement
- Monitoring deception environment for adversary interaction

## When NOT to Use

- Building detection rules or SIEM content → `d3fend-detect`
- System hardening or secure config → `d3fend-harden`
- Network segmentation → `d3fend-isolate`
- Active defense / threat intel → `cybersecurity`
- Adversarial testing (red team) → `ai-redteam` / `offensive-security-analyst`

## Core Workflows

### 1. Decoy Environments (Honeynets)

| Type | Deployment | Use Case |
|---|---|---|
| Standalone | Isolated network segment | Research, early warning |
| Integrated | Blended with production | Insider threat, lateral movement |
| Connected | Linked to real systems | APT detection, TTP collection |

**See `references/honeynets.md`**

### 2. Decoy Objects

- **Decoy files**: Fake documents with tracking (canary tokens)
- **Decoy network resources**: Fake shares, databases, services
- **Decoy personas**: Fake user accounts with believable data
- **Decoy public releases**: Fake credentials on dark web/pastebin
- **Decoy session tokens**: Bait cookies/API keys with monitoring

**See `references/decoy_objects.md`**

### 3. Deception Program Design

1. Define objectives (detection, delay, intelligence)
2. Select deception layers (environment, object, persona)
3. Ensure believability and consistency
4. Monitor and collect adversary TTPs
5. Analyze and feed into threat intelligence

**See `references/deception_program.md`**

## When to load references

- **Honeynets** → `references/honeynets.md`
- **Decoy objects** → `references/decoy_objects.md`
- **Deception program** → `references/deception_program.md`