＋ Add to collection

Install (CLI)

npx skillmds add mukul975/deploying-honeytokens-and-canarytokens

Or Copy and Paste in Your Agent chat

Please install the Agent Skill "mukul975/deploying-honeytokens-and-canarytokens" for me from skillmd.com. A SkillMD skill is a SKILL.md file — plain markdown plus a few companion files — that you save into my skills directory. Use whichever fetch route fits your setup: (1) if you have a terminal, run npx -y skillmds add mukul975/deploying-honeytokens-and-canarytokens; (2) otherwise fetch the file manifest at https://api.skillmd.com/api/skills/mukul975/deploying-honeytokens-and-canarytokens/bundle?format=manifest and download each listed file from its "url" into deploying-honeytokens-and-canarytokens/ in your skills directory; (3) if the SkillMD MCP tools are connected, call skillmd_download with slug "mukul975/deploying-honeytokens-and-canarytokens" and save the returned files under deploying-honeytokens-and-canarytokens/. Show me the SKILL.md before saving if you'd like me to review it. If your skills directory is read-only (e.g. the Claude desktop app), save the files to a working folder instead and tell me — I'll add them through my app's skills settings.

README badge

Show this skill's registry status in your repo:

[![SkillMD](https://skillmd.com/badge/mukul975/deploying-honeytokens-and-canarytokens.svg)](https://skillmd.com/skills/mukul975/deploying-honeytokens-and-canarytokens)

deploying-honeytokens-and-canarytokens

Name: deploying-honeytokens-and-canarytokens
Rating: 4.2 (5 reviews)
Author: mukul975

mukul975/deploying-honeytokens-and-canarytokens · Agent Skill (multi-file)

by mukul975 · bundle

Published Jul 5, 2026 · Last updated Jul 6, 2026

Deploy honeytokens and canarytokens as decoy artifacts to detect intrusions with near-zero false positives.

SKILL.md

Deploying Honeytokens and Canarytokens

Authorized Use Only: Deception assets described here are defensive controls deployed inside your own environment. Deploying tokens, decoy credentials, or honeypots on infrastructure you do not own or administer, or using them to entrap third parties, may violate computer-misuse and privacy law. Deploy only on assets you own or are explicitly authorized to instrument, and route all alert data through approved monitoring channels.

Overview

Honeytokens (a.k.a. canarytokens) are decoy artifacts — credentials, files, URLs, API keys, DNS names, database connection strings, documents — that have no legitimate operational use. Because no authorized user or process should ever touch them, any interaction is a high-fidelity signal of an intrusion, insider misuse, or reconnaissance. Unlike signature- or anomaly-based detection, honeytokens generate near-zero false positives: the alert is the compromise.

Thinkst's open-source Canarytokens project (https://canarytokens.org and the self-hostable thinkst/canarytokens-docker) generates dozens of token types that "phone home" when triggered: an HTTP/web-bug URL that fires on GET, an AWS API key that fires when used against AWS, an MS Word/PDF document that fires on open, a DNS token that fires on resolution, a Slack API token, a Kubernetes kubeconfig, an Azure login certificate, a log4shell payload, and more. Each token is bound to a unique memo (so you know where it was planted) plus an alert channel (email and/or webhook).

This skill maps to MITRE D3FEND's Decoy File (D3-DF), Decoy User Credential (D3-DUC), and Honeytoken techniques. From an ATT&CK perspective, a triggered honey credential most commonly evidences adversary attempts to abuse or modify authentication material (T1556 – Modify Authentication Process and related credential-access activity), giving the SOC an early, unambiguous tripwire deep inside the kill chain — typically after initial access but before lateral movement completes.

When to Use

When you need high-fidelity intrusion detection in segments where traditional telemetry is sparse (file shares, password vaults, code repos, cloud accounts).
When validating that an attacker who reaches a "crown-jewel" host or document store is detected, not just blocked at the perimeter.
When seeding decoy credentials into LSASS-reachable memory, browser stores, .aws/credentials, or password managers to catch credential dumping and reuse.
When instrumenting documents, repos, or wikis to catch data theft and ransomware staging.
When building a MITRE D3FEND-aligned deception layer as part of a defense-in-depth or zero-trust program.

Prerequisites

Docker Engine and Docker Compose v2 for self-hosting (docker compose version).
A registered domain you control plus DNS delegation for DNS-based tokens (NS records pointing at your switchboard host).
A public IPv4 address reachable on 80/443 (HTTP tokens) and 53/udp (DNS tokens).
An SMTP relay or Mailgun account, and/or a Slack/Teams/generic webhook URL for alert delivery.
Python 3.8+ for the helper script:
```
python3 -m pip install requests
```
For quick use with no hosting, an account-free token from the public service at https://canarytokens.org.

Objectives

Stand up a self-hosted Canarytokens instance (or use the public service) with working alerting.
Generate the major token types (HTTP, DNS, AWS key, MS Word/PDF, Slack, kubeconfig) with descriptive memos.
Plant decoy credentials and decoy files in realistic, monitored locations.
Validate that each token fires and that alerts reach the SOC channel.
Catalogue deployed tokens and map them to MITRE D3FEND/ATT&CK for coverage tracking.

MITRE ATT&CK Mapping

ID	Official Technique Name	Relevance
T1556	Modify Authentication Process	A triggered honey credential reveals an adversary harvesting/abusing authentication material; the decoy provides a detection tripwire for credential abuse activity.

Related MITRE D3FEND defensive techniques (the offensive counter-mapping for this control):

D3FEND ID	Technique	Role
D3-DF	Decoy File	Canary documents, fake configs, decoy archives placed and monitored.
D3-DUC	Decoy User Credential	Honey credentials (AWS keys, AD accounts, kubeconfig) integrated with a monitored decoy asset.
D3-DO	Decoy Object	Umbrella for honeytokens/canarytokens as monitored decoy artifacts.

Workflow

1. Deploy a self-hosted Canarytokens switchboard

Clone the official Docker repo and create the two environment files from their distributed templates:

git clone https://github.com/thinkst/canarytokens-docker
cd canarytokens-docker
cp switchboard.env.dist switchboard.env
cp frontend.env.dist frontend.env

Set the core variables. In frontend.env:

CANARY_DOMAINS=canary.example.com          # general-purpose token domains (comma-separated)
CANARY_NXDOMAINS=nx.example.com            # domains reserved for PDF/DNS tokens
CANARY_PUBLIC_IP=203.0.113.10              # public IP of this host

In switchboard.env:

CANARY_PUBLIC_DOMAIN=canary.example.com
CANARY_MAILGUN_DOMAIN_NAME=mg.example.com
CANARY_MAILGUN_API_KEY=key-xxxxxxxxxxxxxxxx
CANARY_ALERT_EMAIL_FROM_ADDRESS=canary@example.com
CANARY_ALERT_EMAIL_FROM_DISPLAY=Canarytokens
CANARY_ALERT_EMAIL_SUBJECT=Canarytoken Triggered
# WireGuard token seed:
# dd bs=32 count=1 if=/dev/urandom 2>/dev/null | base64
CANARY_WG_PRIVATE_KEY_SEED=<base64-seed>

2. Bring the stack up

docker compose up -d
# HTTPS with automatic Let's Encrypt certs (after editing certbot.env):
# docker compose -f docker-compose-letsencrypt.yml up -d
docker compose ps
docker compose logs -f frontend

The frontend (token generator UI) is now served on your CANARY_PUBLIC_DOMAIN; the switchboard listens on 80/443 and 53/udp to receive triggers.

3. Generate an HTTP (web-bug) token via the API

Both the public service and a self-hosted frontend expose a POST /generate endpoint. Create an HTTP token that fires on any GET:

curl -s https://canarytokens.org/generate \
  -F 'type=http' \
  -F 'email=soc@example.com' \
  -F 'memo=Internal wiki - IT admin passwords page' \
  -F 'webhook_url=https://hooks.slack.com/services/T000/B000/XXXX'
# Response JSON includes: token, auth, hostname, url, url_components

The returned url is the trip-wire link; place it where only an intruder would find it (a fake bookmark, a hidden link in a wiki page, an email signature).

4. Generate a cloud credential (AWS API key) honeytoken

curl -s https://canarytokens.org/generate \
  -F 'type=aws_keys' \
  -F 'email=soc@example.com' \
  -F 'memo=Decoy AWS keys - jenkins build host /root/.aws/credentials'
# Response contains access_key_id and secret_access_key plus a downloadable
# credentials file via /download?token=<token>&auth=<auth>&fmt=aws_keys

Drop the keys into a plausible ~/.aws/credentials on a monitored host. Any sts:GetCallerIdentity or other AWS call using them triggers an alert with the source IP and user agent.

5. Generate a document token (MS Word / PDF) for data-theft detection

# MS Word
curl -s https://canarytokens.org/generate \
  -F 'type=msword' \
  -F 'email=soc@example.com' \
  -F 'memo=Q4-Layoffs-DRAFT.docx on FILESERVER01\\HR$' \
  -o token-meta.json
# Download the weaponized document:
curl -s "https://canarytokens.org/download?fmt=msword&token=<token>&auth=<auth>" -o Q4-Layoffs-DRAFT.docx

For PDFs use type=adobe_pdf. The document phones home when opened (DNS/HTTP callback), exposing the reader's IP.

6. Plant a DNS token for resolver-level tripwires

curl -s https://canarytokens.org/generate \
  -F 'type=dns' \
  -F 'email=soc@example.com' \
  -F 'memo=DNS canary referenced in backup script comments'
# Response 'hostname' is a unique FQDN; any resolution of it fires an alert.

Embed the hostname in scripts, configs, or /etc/hosts comments. Because resolution alone triggers it, DNS tokens catch reconnaissance even when egress HTTP is blocked.

7. Generate infrastructure tokens (Slack, kubeconfig, Azure)

# Slack API token canary (fires when the fake token is used against Slack)
curl -s https://canarytokens.org/generate -F 'type=slack_api' \
  -F 'email=soc@example.com' -F 'memo=Decoy Slack bot token in repo .env'

# Kubeconfig canary (fires when used against the kube API)
curl -s https://canarytokens.org/generate -F 'type=kubeconfig' \
  -F 'email=soc@example.com' -F 'memo=Decoy kubeconfig in /home/deploy/.kube/config'

Commit decoy .env / kubeconfig files only to repos and hosts you instrument, never to public repos.

8. Plant Active Directory honey credentials (decoy user)

Create a non-privileged-looking but never-used AD account whose authentication is alerted on. Set a SPN so it appears Kerberoastable bait, and forward Event ID 4768/4769/4625 for it to your SIEM:

New-ADUser -Name "svc_backup_legacy" -SamAccountName "svc_backup_legacy" `
  -AccountPassword (ConvertTo-SecureString 'C0mpl3xDecoy!2026' -AsPlainText -Force) `
  -Enabled $true -Description "Legacy backup service (do not use)"
Set-ADUser svc_backup_legacy -ServicePrincipalNames @{Add="MSSQLSvc/decoy.example.com:1433"}

Add a Windows audit ACL/SACL or a SIEM correlation rule so any 4768/4769 for svc_backup_legacy pages the SOC — no legitimate logon should ever occur.

9. Validate and catalogue

Trigger each token from a controlled host and confirm the alert lands:

# HTTP token
curl -s "https://canary.example.com/<token-url>" >/dev/null
# DNS token
dig +short <unique-hostname>
# AWS key token
AWS_ACCESS_KEY_ID=<id> AWS_SECRET_ACCESS_KEY=<secret> aws sts get-caller-identity

Record each deployed token (type, memo, location, alert channel, D3FEND mapping) in an inventory. Use the helper script below to bulk-generate and export this inventory as JSON.

Tools and Resources

Tool / Resource	Purpose	Link
Canarytokens (public)	Free hosted token generation	https://canarytokens.org
canarytokens-docker	Self-hosted switchboard + frontend	https://github.com/thinkst/canarytokens-docker
canarytokens (core)	Source for the token engine	https://github.com/thinkst/canarytokens
Canarytokens docs	Per-token-type usage guides	https://docs.canarytokens.org
MITRE D3FEND	Defensive technique taxonomy (D3-DF, D3-DUC)	https://d3fend.mitre.org
MITRE ATT&CK T1556	Modify Authentication Process	https://attack.mitre.org/techniques/T1556/

Token Type Reference

`type` value	Token	Fires when
`http`	Web-bug URL	URL is requested (GET)
`dns`	DNS name	Hostname is resolved
`aws_keys`	AWS API key	Keys used against AWS
`msword` / `adobe_pdf`	Office/PDF document	Document is opened
`slack_api`	Slack API token	Token used against Slack
`kubeconfig`	Kubernetes config	Used against the kube API
`azure_id`	Azure login certificate	Cert used to authenticate to Azure
`qr_code`	QR code	Encoded URL is requested
`web_image`	Image web-bug	Image is loaded
`log4shell`	Log4j JNDI string	Vulnerable logger evaluates it
`cmd`	Sensitive command (Windows)	Process/command is executed

Validation Criteria

Self-hosted switchboard (or public service) deployed and reachable on 80/443 and 53/udp.
Alert channel (email and/or webhook) configured and test alert received.
At least one each of HTTP, DNS, cloud-credential, and document tokens generated with descriptive memos.
Decoy credentials planted in realistic, monitored locations (no production secrets co-located).
AD honey account created with SACL/SIEM rule firing on any authentication.
Each token validated by a controlled trigger; alert confirmed end-to-end.
Token inventory exported (type, memo, location, alert channel, D3-DF/D3-DUC mapping).
No tokens committed to public repositories or planted on out-of-scope systems.

---
name: deploying-honeytokens-and-canarytokens
description: Deploy honeytokens and canarytokens as decoy artifacts to detect intrusions with near-zero false positives.
license: Apache-2.0
---
# Deploying Honeytokens and Canarytokens

> **Authorized Use Only:** Deception assets described here are defensive controls deployed inside your own environment. Deploying tokens, decoy credentials, or honeypots on infrastructure you do not own or administer, or using them to entrap third parties, may violate computer-misuse and privacy law. Deploy only on assets you own or are explicitly authorized to instrument, and route all alert data through approved monitoring channels.

## Overview

Honeytokens (a.k.a. canarytokens) are decoy artifacts — credentials, files, URLs, API keys, DNS names, database connection strings, documents — that have no legitimate operational use. Because no authorized user or process should ever touch them, **any** interaction is a high-fidelity signal of an intrusion, insider misuse, or reconnaissance. Unlike signature- or anomaly-based detection, honeytokens generate near-zero false positives: the alert *is* the compromise.

Thinkst's open-source **Canarytokens** project (https://canarytokens.org and the self-hostable `thinkst/canarytokens-docker`) generates dozens of token types that "phone home" when triggered: an HTTP/web-bug URL that fires on GET, an AWS API key that fires when used against AWS, an MS Word/PDF document that fires on open, a DNS token that fires on resolution, a Slack API token, a Kubernetes `kubeconfig`, an Azure login certificate, a `log4shell` payload, and more. Each token is bound to a unique `memo` (so you know *where* it was planted) plus an alert channel (email and/or webhook).

This skill maps to MITRE D3FEND's **Decoy File (D3-DF)**, **Decoy User Credential (D3-DUC)**, and **Honeytoken** techniques. From an ATT&CK perspective, a triggered honey credential most commonly evidences adversary attempts to abuse or modify authentication material (**T1556 – Modify Authentication Process** and related credential-access activity), giving the SOC an early, unambiguous tripwire deep inside the kill chain — typically after initial access but before lateral movement completes.

## When to Use

- When you need high-fidelity intrusion detection in segments where traditional telemetry is sparse (file shares, password vaults, code repos, cloud accounts).
- When validating that an attacker who reaches a "crown-jewel" host or document store is detected, not just blocked at the perimeter.
- When seeding decoy credentials into LSASS-reachable memory, browser stores, `.aws/credentials`, or password managers to catch credential dumping and reuse.
- When instrumenting documents, repos, or wikis to catch data theft and ransomware staging.
- When building a MITRE D3FEND-aligned deception layer as part of a defense-in-depth or zero-trust program.

## Prerequisites

- Docker Engine and Docker Compose v2 for self-hosting (`docker compose version`).
- A registered domain you control plus DNS delegation for DNS-based tokens (NS records pointing at your switchboard host).
- A public IPv4 address reachable on 80/443 (HTTP tokens) and 53/udp (DNS tokens).
- An SMTP relay or Mailgun account, and/or a Slack/Teams/generic webhook URL for alert delivery.
- Python 3.8+ for the helper script:
  ```bash
  python3 -m pip install requests
  ```
- For quick use with no hosting, an account-free token from the public service at https://canarytokens.org.

## Objectives

- Stand up a self-hosted Canarytokens instance (or use the public service) with working alerting.
- Generate the major token types (HTTP, DNS, AWS key, MS Word/PDF, Slack, kubeconfig) with descriptive memos.
- Plant decoy credentials and decoy files in realistic, monitored locations.
- Validate that each token fires and that alerts reach the SOC channel.
- Catalogue deployed tokens and map them to MITRE D3FEND/ATT&CK for coverage tracking.

## MITRE ATT&CK Mapping

| ID | Official Technique Name | Relevance |
|----|------------------------|-----------|
| T1556 | Modify Authentication Process | A triggered honey credential reveals an adversary harvesting/abusing authentication material; the decoy provides a detection tripwire for credential abuse activity. |

**Related MITRE D3FEND defensive techniques** (the offensive counter-mapping for this control):

| D3FEND ID | Technique | Role |
|-----------|-----------|------|
| D3-DF | Decoy File | Canary documents, fake configs, decoy archives placed and monitored. |
| D3-DUC | Decoy User Credential | Honey credentials (AWS keys, AD accounts, kubeconfig) integrated with a monitored decoy asset. |
| D3-DO | Decoy Object | Umbrella for honeytokens/canarytokens as monitored decoy artifacts. |

## Workflow

### 1. Deploy a self-hosted Canarytokens switchboard
Clone the official Docker repo and create the two environment files from their distributed templates:
```bash
git clone https://github.com/thinkst/canarytokens-docker
cd canarytokens-docker
cp switchboard.env.dist switchboard.env
cp frontend.env.dist frontend.env
```
Set the core variables. In `frontend.env`:
```ini
CANARY_DOMAINS=canary.example.com          # general-purpose token domains (comma-separated)
CANARY_NXDOMAINS=nx.example.com            # domains reserved for PDF/DNS tokens
CANARY_PUBLIC_IP=203.0.113.10              # public IP of this host
```
In `switchboard.env`:
```ini
CANARY_PUBLIC_DOMAIN=canary.example.com
CANARY_MAILGUN_DOMAIN_NAME=mg.example.com
CANARY_MAILGUN_API_KEY=key-xxxxxxxxxxxxxxxx
CANARY_ALERT_EMAIL_FROM_ADDRESS=canary@example.com
CANARY_ALERT_EMAIL_FROM_DISPLAY=Canarytokens
CANARY_ALERT_EMAIL_SUBJECT=Canarytoken Triggered
# WireGuard token seed:
# dd bs=32 count=1 if=/dev/urandom 2>/dev/null | base64
CANARY_WG_PRIVATE_KEY_SEED=<base64-seed>
```

### 2. Bring the stack up
```bash
docker compose up -d
# HTTPS with automatic Let's Encrypt certs (after editing certbot.env):
# docker compose -f docker-compose-letsencrypt.yml up -d
docker compose ps
docker compose logs -f frontend
```
The frontend (token generator UI) is now served on your `CANARY_PUBLIC_DOMAIN`; the switchboard listens on 80/443 and 53/udp to receive triggers.

### 3. Generate an HTTP (web-bug) token via the API
Both the public service and a self-hosted frontend expose a `POST /generate` endpoint. Create an HTTP token that fires on any GET:
```bash
curl -s https://canarytokens.org/generate \
  -F 'type=http' \
  -F 'email=soc@example.com' \
  -F 'memo=Internal wiki - IT admin passwords page' \
  -F 'webhook_url=https://hooks.slack.com/services/T000/B000/XXXX'
# Response JSON includes: token, auth, hostname, url, url_components
```
The returned `url` is the trip-wire link; place it where only an intruder would find it (a fake bookmark, a hidden link in a wiki page, an email signature).

### 4. Generate a cloud credential (AWS API key) honeytoken
```bash
curl -s https://canarytokens.org/generate \
  -F 'type=aws_keys' \
  -F 'email=soc@example.com' \
  -F 'memo=Decoy AWS keys - jenkins build host /root/.aws/credentials'
# Response contains access_key_id and secret_access_key plus a downloadable
# credentials file via /download?token=<token>&auth=<auth>&fmt=aws_keys
```
Drop the keys into a plausible `~/.aws/credentials` on a monitored host. Any `sts:GetCallerIdentity` or other AWS call using them triggers an alert with the source IP and user agent.

### 5. Generate a document token (MS Word / PDF) for data-theft detection
```bash
# MS Word
curl -s https://canarytokens.org/generate \
  -F 'type=msword' \
  -F 'email=soc@example.com' \
  -F 'memo=Q4-Layoffs-DRAFT.docx on FILESERVER01\\HR$' \
  -o token-meta.json
# Download the weaponized document:
curl -s "https://canarytokens.org/download?fmt=msword&token=<token>&auth=<auth>" -o Q4-Layoffs-DRAFT.docx
```
For PDFs use `type=adobe_pdf`. The document phones home when opened (DNS/HTTP callback), exposing the reader's IP.

### 6. Plant a DNS token for resolver-level tripwires
```bash
curl -s https://canarytokens.org/generate \
  -F 'type=dns' \
  -F 'email=soc@example.com' \
  -F 'memo=DNS canary referenced in backup script comments'
# Response 'hostname' is a unique FQDN; any resolution of it fires an alert.
```
Embed the hostname in scripts, configs, or `/etc/hosts` comments. Because resolution alone triggers it, DNS tokens catch reconnaissance even when egress HTTP is blocked.

### 7. Generate infrastructure tokens (Slack, kubeconfig, Azure)
```bash
# Slack API token canary (fires when the fake token is used against Slack)
curl -s https://canarytokens.org/generate -F 'type=slack_api' \
  -F 'email=soc@example.com' -F 'memo=Decoy Slack bot token in repo .env'

# Kubeconfig canary (fires when used against the kube API)
curl -s https://canarytokens.org/generate -F 'type=kubeconfig' \
  -F 'email=soc@example.com' -F 'memo=Decoy kubeconfig in /home/deploy/.kube/config'
```
Commit decoy `.env` / `kubeconfig` files only to repos and hosts you instrument, never to public repos.

### 8. Plant Active Directory honey credentials (decoy user)
Create a non-privileged-looking but never-used AD account whose authentication is alerted on. Set a SPN so it appears Kerberoastable bait, and forward Event ID 4768/4769/4625 for it to your SIEM:
```powershell
New-ADUser -Name "svc_backup_legacy" -SamAccountName "svc_backup_legacy" `
  -AccountPassword (ConvertTo-SecureString 'C0mpl3xDecoy!2026' -AsPlainText -Force) `
  -Enabled $true -Description "Legacy backup service (do not use)"
Set-ADUser svc_backup_legacy -ServicePrincipalNames @{Add="MSSQLSvc/decoy.example.com:1433"}
```
Add a Windows audit ACL/SACL or a SIEM correlation rule so any 4768/4769 for `svc_backup_legacy` pages the SOC — no legitimate logon should ever occur.

### 9. Validate and catalogue
Trigger each token from a controlled host and confirm the alert lands:
```bash
# HTTP token
curl -s "https://canary.example.com/<token-url>" >/dev/null
# DNS token
dig +short <unique-hostname>
# AWS key token
AWS_ACCESS_KEY_ID=<id> AWS_SECRET_ACCESS_KEY=<secret> aws sts get-caller-identity
```
Record each deployed token (type, memo, location, alert channel, D3FEND mapping) in an inventory. Use the helper script below to bulk-generate and export this inventory as JSON.

## Tools and Resources

| Tool / Resource | Purpose | Link |
|-----------------|---------|------|
| Canarytokens (public) | Free hosted token generation | https://canarytokens.org |
| canarytokens-docker | Self-hosted switchboard + frontend | https://github.com/thinkst/canarytokens-docker |
| canarytokens (core) | Source for the token engine | https://github.com/thinkst/canarytokens |
| Canarytokens docs | Per-token-type usage guides | https://docs.canarytokens.org |
| MITRE D3FEND | Defensive technique taxonomy (D3-DF, D3-DUC) | https://d3fend.mitre.org |
| MITRE ATT&CK T1556 | Modify Authentication Process | https://attack.mitre.org/techniques/T1556/ |

## Token Type Reference

| `type` value | Token | Fires when |
|--------------|-------|-----------|
| `http` | Web-bug URL | URL is requested (GET) |
| `dns` | DNS name | Hostname is resolved |
| `aws_keys` | AWS API key | Keys used against AWS |
| `msword` / `adobe_pdf` | Office/PDF document | Document is opened |
| `slack_api` | Slack API token | Token used against Slack |
| `kubeconfig` | Kubernetes config | Used against the kube API |
| `azure_id` | Azure login certificate | Cert used to authenticate to Azure |
| `qr_code` | QR code | Encoded URL is requested |
| `web_image` | Image web-bug | Image is loaded |
| `log4shell` | Log4j JNDI string | Vulnerable logger evaluates it |
| `cmd` | Sensitive command (Windows) | Process/command is executed |

## Validation Criteria

- [ ] Self-hosted switchboard (or public service) deployed and reachable on 80/443 and 53/udp.
- [ ] Alert channel (email and/or webhook) configured and test alert received.
- [ ] At least one each of HTTP, DNS, cloud-credential, and document tokens generated with descriptive memos.
- [ ] Decoy credentials planted in realistic, monitored locations (no production secrets co-located).
- [ ] AD honey account created with SACL/SIEM rule firing on any authentication.
- [ ] Each token validated by a controlled trigger; alert confirmed end-to-end.
- [ ] Token inventory exported (type, memo, location, alert channel, D3-DF/D3-DUC mapping).
- [ ] No tokens committed to public repositories or planted on out-of-scope systems.

Files

This skill is a package of 5 files. Install with the command above, or download the folder.

📄SKILL.md entry
📁references
📄api-reference.md 3.5 KB
📄standards.md 1.5 KB
📁scripts
⚙️agent.py 6.6 KB
📄LICENSE 11.0 KB

mukul975/Anthropic-Cybersecurity-Skills/tree/main/skills/deploying-honeytokens-and-canarytokens commit · 673da1f3b0

▌
implementing-canary-tokens-for-network-intrusion · mukul975 bundle
Deploys DNS, HTTP, and AWS API key canary tokens across network infrastructure to detect unauthorized access and lateral movement, with webhook alerting to Slack, Teams, email, or generic HTTP endpoints.

24.6k
repo stars
▌
deploying-active-directory-honeytokens · mukul975 bundle
Deploys deception-based honeytokens in Active Directory, including fake privileged accounts, SPNs for Kerberoasting detection, decoy GPOs with cpassword traps, and deceptive BloodHound paths, with monitoring for Windows Security Event IDs.

24.6k
repo stars
▌
implementing-honeytokens-for-breach-detection · mukul975 bundle
Deploys canary tokens and honeytokens (fake AWS credentials, DNS canaries, document beacons, database records) that trigger alerts when accessed by attackers. Uses the Canarytokens API and custom webhook integrations for breach detection.

24.6k
repo stars
▌
detecting-container-escape-attempts · mukul975 bundle
Detect container escape attempts using runtime security tools like Falco, Sysdig, and custom seccomp/audit rules.

24.6k
repo stars
▌
deploying-decoy-files-for-ransomware-detection · mukul975 bundle
Deploys canary files (honeytokens) across file systems to detect ransomware encryption activity in real time using file integrity monitoring or OS-level watchdogs.

24.6k
repo stars
▌
aeon-on-chain-monitor · bankrbot bundle
Monitors EVM blockchain addresses and contracts for large transfers, new approvals, contract upgrades, unusual gas spends, MEV interactions, and first-time interactions with new contracts.

1.2k
repo stars

Frequently asked questions

How do I install the deploying-honeytokens-and-canarytokens skill?

Run npx skillmds add mukul975/deploying-honeytokens-and-canarytokens in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the deploying-honeytokens-and-canarytokens skill do?

Deploy honeytokens and canarytokens as decoy artifacts to detect intrusions with near-zero false positives. It is listed under Security, Coding & Dev Tools, Incident Response on SkillMD.

Is deploying-honeytokens-and-canarytokens safe to use?

SkillMD's automated safety review verdict for this skill is CAUTION. Independent scanners report: SkillSpector: CAUTION, Skill Scanner: PASS. Capability flags: executes scripts, makes network calls, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with deploying-honeytokens-and-canarytokens?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is deploying-honeytokens-and-canarytokens free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under Apache-2.

Who published deploying-honeytokens-and-canarytokens?

mukul975 (@mukul975) published this skill. Their other Agent Skills are listed on their SkillMD profile.