Honeypots y deception: T-Pot, canary tokens y honeyusers en AD

2026-11-06 · 10 min de lectura

Defensa activa con deception: honeypots (T-Pot, Conpot), canary tokens (Thinkst), honeyusers y honeycreds en AD. Aprende a diseñar deception landscape que detecte atacantes sofisticados en primeras etapas sin falsos positivos.

Honeypots y deception son el enfoque defensivo que invierte la lógica tradicional: en vez de solo monitorear tu red buscando señales de atacante, plantas trampas diseñadas para no tener razón legítima de ser accedidas. Si algo las toca, es ataque por definición, generando cero falsos positivos por diseño. Desde los honeypots tradicionales (sistemas enteros emulando servicios vulnerables) hasta los canary tokens modernos (archivos, keys, URLs que alertan al ser accedidos), deception ha evolucionado para ser práctica y escalable.

Esta lección cubre el espectro completo: honeypots low/medium/high interaction, frameworks modernos (T-Pot, Conpot, Cowrie), canary tokens gratuitos de Thinkst Canary, honeyusers y honeycreds en Active Directory (dcsync honey, kerberoast bait), y diseño de deception landscape coherente. Es la segunda lección del bloque defense ampliada de la Tanda 6.

Deception se implementa en infraestructura propia. Testing honeypots públicos de terceros sin autorización puede alertar los operadores legítimos y es de dudosa legalidad.

Tipos de honeypots#

Low interaction#

Emulan servicios básicos; limited capabilities para engagement con atacante. Captura reconnaissance, basic exploits.

Examples:

Dionaea: emula HTTP, FTP, SMB.
Cowrie: SSH + Telnet honeypot.
Thug: client honeypot for web malware.

Pros: Low risk, easy deployment, scalable.

Cons: Smart attacker reconoce rápido.

Medium interaction#

Más elaborados, simulate fuller services, puede engage longer. Catch more sophisticated attempts.

Cowrie en high interaction mode: fake filesystem navigable.
Honeytrap: dynamic service emulation.
Dionaea con extensive protocol support.

High interaction#

Full real OS/applications, intentionally vulnerable. Attacker interacts como con real system. Maximum intelligence gathering, higher risk.

Kippo historical.
Real VMs intentionally vulnerable como honeypots.
Specialized: Conpot for ICS/SCADA honeypots (hooks previous ICS lesson).

Pros: Rich intelligence, catches sophisticated attackers.

Cons: Compromise risk real, operational overhead.

Pure honeypots#

Full production-like system set up solo para attract and study attackers. Research-oriented, not operational.

T-Pot: la suite moderna#

T-Pot (Deutsche Telekom) es collection all-in-one de honeypots. Deploys multiple honeypots on single VM con unified dashboard (ELK stack).

Includes:

Cowrie (SSH/Telnet).
Dionaea (multi-protocol).
Honeytrap.
Elasticpot (Elasticsearch).
Rdpy (RDP).
Snare + Tanner (web).
Mailoney (SMTP).
Heralding (brute force detection).

Install:

# En Ubuntu VM
git clone https://github.com/telekom-security/tpotce
cd tpotce/iso/installer
./install.sh --type=user
# Dashboard en https://tpot-ip:64297

Para research y education, exceptional value. Para enterprise deception, complement con solutions comerciales.

Canary tokens#

Thinkst Canary Tokens (free service) creaste tokens que alert cuando triggered:

DNS token: unique domain, alert on resolution.
HTTP URL token: URL, alert on request.
Document token: PDF/Word, alert on open.
AWS/Azure API key token: fake credentials, alert on use.
Mysql / Postgresql token: config file.
Slack webhook token.
Cloned website token.

Use cases:

Document token en shared folder "Executive Compensation 2026.pdf". Attacker browsing shares opens it → alert.
Fake AWS credentials en file "config" en home directory. Attacker running tools uses them → alert.
DNS token en email signature as fake URL "VPN access documentation". Attacker inspects email → alert.
Kubernetes config token: fake kubeconfig in user profile.

Zero false positives por design. Alerts means definitive attacker activity.

Herramientas pagadas: Thinkst Canary (hardware/VM honeypots full-featured), Illusive Networks (comercial), Attivo Networks.

Honeyusers y honeycreds en AD#

Active Directory offers rich deception landscape:

Honeyuser con SPN juicy#

Create AD user con SPN registered attractive para Kerberoasting attackers:

Nombre: svc_sql_admin o administrador_bd.
SPN: MSSQLSvc/sql-prod.corp.lab:1433.
Password: long random, never used legitimately.
Nobody logins con él.
Monitor Kerberos TGS requests para este SPN.

Any TGS request for this SPN = Kerberoasting attempt. Immediate alert.

Honeycreds en memory#

Deploy fake credentials en LSASS / Credential Manager de workstations específicas. Attacker running Mimikatz o similar sees them, attempts use → alert con detection rule.

ACL deception#

Set ACLs attractive but monitored:

User con GenericWrite sobre Domain Admin: attractive BloodHound path, pero monitored.
Any attempt to use these permissi

DCSync bait#

Usuario con DS-Replication-Get-Changes sobre DC. Monitored CloudTrail-equivalent (event 4662 en DC).

LAPS honeypots#

Fake LAPS passwords en computers específicas. Any access = alert.

Deception design principles#

Para deception landscape efectivo:

Realismo: debe parecer real, con documentation, usage history, etc.
Accessibility: attacker debe poder encontrar. No demasiado hidden.
Isolation: no debe afectar operations legítimas.
Monitoring: alerts must reach right people fast.
Variety: different types para catch different attacker stages (recon, lateral, data access).
Decoy integration: honeypots look like part de real infrastructure.
Testing: red team tests que deception works.

Monitoring y SIEM integration#

Deception assets integrate con SIEM:

Splunk / Sentinel rules on canary token triggers.
SOAR playbooks para automatic response.
Threat hunting queries con deception data como baseline.
Dashboards específicos para deception events.

Modern platforms (Splunk Enterprise Security, Microsoft Sentinel) tienen integrations prebuilt con Thinkst Canary.

Legal considerations#

Entrapment generally not concern para deception (passive monitoring, not luring).
Terms of service: deception within your own network, your rules.
Privacy laws: if honeypots receive data from third parties, GDPR/privacy laws apply. Minimize.
Attribution: careful con offensive responses (counterstrikes) are typically illegal.

Casos reales#

Thinkst Canary reportes múltiples enterprises catching APTs in early recon stages via document tokens.
AD honeyusers catching Kerberoasting attempts en multiple consulting engagements documented by SpecterOps y similar.
T-Pot deployments in research networks providing threat intelligence feeds.
Illusive Networks case studies showing deception detecting attackers meses after initial breach, saving organizations from major incidents.

Walkthrough: setup deception landscape#

Para fijar el patrón, construir deception coherente en empresa mediana:

Semana 1 - Perimeter honeypots:

Deploy T-Pot VM en DMZ con public IP.
Configure alerts to SOC Slack channel.
Monitor by baseline for first week (expect mostly bots scanning).

Semana 2 - Internal honeypots:

Deploy fake file server "finance-archive".
Shares con documents attractive ("Payroll 2026.xlsx", "M&A Documents").
Canary document tokens dentro.

Semana 3 - AD deception:

Create honeyuser svc_mssql_prod con SPN.
Password secure, nobody logins ever.
Alert rule en SIEM: TGS request for SPN = alert.
Repeat para svc_oracle, svc_backup.

Semana 4 - Workstation deception:

Deploy canary tokens en select workstations (executive assistants).
Fake AWS credentials config.
Fake kubeconfig files.

Semana 5 - Monitoring tuning:

Review alerts received.
False positives usually zero.
Any alert should be investigated immediately.

Semana 6 - Red team validation:

Internal red team tests deception.
Simulates attacker path: recon → lateral → data access.
Verify deception triggers alerts at right stages.

Rol en moderna cyber defense#

Deception en 2026 es component standard de mature security programs:

MITRE Shield framework: active defense + deception specific guidance.
Gartner recognizing deception como mainstream component.
ISO 27001 actualizaciones considering deception en annex controls.
NIS2 directive including deception entre recommended controls.

Compared con pure detection approach, deception shifts advantage back to defender: attacker must avoid unknowns (every asset potentially trap), overhead growing con each cautious step.

Errores comunes#

Honeypots obviously fake (hostname "honeypot-01").
Canary tokens placed incorrectly (invisible to realistic attacker path).
Alerts not integrated con SOC workflow (ignored).
Deception sin maintenance (outdated OS, obvious staleness).
Only external honeypots (miss internal lateral movement).
Honeyusers con naming patterns inconsistent con real users.

Preguntas frecuentes#

¿Honeypots legal en empresa?#

Yes, within your own network. Monitor your infrastructure como quieras.

¿Vale la pena Thinkst Canary pagado?#

Para enterprise sí. Hardware honeypots pre-configured, extensive catalog de services, managed alerting. Free Canary Tokens suficientes para small org.

¿Deception reemplaza EDR?#

No, complements. EDR detecta malicious behavior known patterns. Deception detects any activity on specific assets regardless de technique. Combined provides defense in depth.

¿Attacker lo descubre?#

Smart attackers sí identifican honeypots específicos. Pero multi-layered deception + variety de types makes avoiding all expensive para attacker. Even detection attempts generate intelligence.

¿Cómo justifico ROI deception al management?#

Each confirmed alert = potentially prevented breach. Dwell time reduction. Industry reports mostrar deception reduces dwell time 50-80%. Cost per alert bajo compared con breach cost.

¿Dónde practico?#

El laboratorio snort de whoami-labs incluye setup T-Pot + canary tokens scattered through fake infrastructure. Practicas deployment, integration con SIEM, testing como red teamer attempting to detect deception.

¿Vale la pena deception en pequeña org?#

Yes. Free Canary Tokens exigen minutos de setup y alertan definitively. Incluso pequeñas empresas con sensitive data benefit. Entry cost es prácticamente cero.

¿Deception y zero trust?#

Complementary. Zero trust reduce blast radius. Deception detects attackers temprano. Combined, dramatic improvement en defensive posture.

¿Research vs operational honeypots?#

Research: pure honeypots public para threat intelligence. Operational: within own network para detection. Different purposes, different risk profiles.

¿Cuánto esfuerzo mantener deception?#

Initial setup: días-semanas. Ongoing: horas/mes para review, update, test. Significantly less que SIEM tuning.

¿Attribución de atacantes via deception?#

Rarely useful alone. Attacker IP typically hidden. But patterns, TTPs learnable from engagement, useful para blue team adaptation.

¿Deception detecting insiders?#

Yes y particularly valuable. Insider threats harder to detect than external. Document tokens en executive shares catch insiders browsing unauthorized.

¿Open source vs commercial?#

Open source (T-Pot, Conpot, Canarytokens free) excellent para learning y small-mid size. Commercial (Thinkst Canary hardware, Illusive) for enterprise con managed support y broader catalog.

Resumen#

Deception: trampas diseñadas para que acceso = attack signal. Zero false positives por design.
Spectrum: low / medium / high interaction honeypots + pure honeypots.
T-Pot: suite all-in-one Deutsche Telekom. Multi-honeypot con ELK dashboard.
Canary tokens (Thinkst): DNS, document, AWS keys, Mysql config. Free service.
AD deception: honeyusers con SPN juicy, honeycreds, LAPS honeypots, ACL bait.
Design principles: realism, accessibility, isolation, variety, monitoring integration.
SIEM integration para automated response workflows.

Deception vs honeypot: semánticas#

La distinción es sutil pero importante:

Honeypot: single asset designed to attract attackers. Historical origin.
Honeynet: network de honeypots cooperating.
Deception technology: broader strategy que incluye honeypots + canary tokens + fake AD objects + decoys en multiple layers.
Active defense: umbrella term incluyendo deception + threat hunting + counter-intelligence.

En 2026 "deception" is preferred term. Emphasis en strategy coherent, not isolated honeypots.

ROI casos documentados#

Industry reports muestran benefits concretos:

Dwell time reduction: 50-80% en empresas que implementan deception maduro.
MTTR (Mean Time to Respond): substantial decrease cuando alerts son definitive.
False positive ratio: near zero con properly designed deception.
Attacker cost: significantly higher (must verify each potential target).
Investment: moderate for mid-market, low for small org con free tools.

Deception es one of highest-ROI investments en security program que las orgs tend to under-invest in. Awareness creciendo 2024-2026 driven por regulatory recommendations (NIS2, MITRE Shield framework formalization).

La próxima lección entra en OSINT avanzado con focus geolocation y SOCMINT, dominios donde la línea entre offensive y defensive investigation se difumina y donde equipos de threat intelligence usan técnicas sofisticadas para rastrear actores maliciosos, investigar brechas, y preparar defense preemptive contra campañas emergentes que podrían afectar a la organización corporativa en los próximos meses del ciclo defensivo anual del equipo de seguridad corporativa interno a cargo.

En conjunto, las técnicas de deception transforman radicalmente la economía del ataque: el atacante debe desconfiar de cualquier recurso que encuentre, verificar cada paso, y aceptar que cualquier acción puede estar siendo observada por los defensores de la organización objetivo.