Open software2025
Material reviewed: Repository metadataEditor contributionExperimental framework generating fictitious user profiles and activity for decoy environments; the repository documents narratives, profiles and language-model integration.
EndpointNetworkDecoyAdversary engagement
Open software2015
Material reviewed: Repository metadataRepository about capture of USB-propagated malware; documentation and maintenance require further review.
EndpointHoneypot
Open software—
Material reviewed: Repository documentationScript for generating VirtualBox templates that make virtual machines harder to detect. It can support a less recognizable decoy VM, but the documentation does not present it as a honeypot.
Endpoint
Open software—
Material reviewed: Repository documentationArgos is an advertised honeypot using dynamic taint analysis to detect and analyze control flow attacks.
NetworkEndpointHoneypot
Open software—
Material reviewed: Repository documentationAn academic project that deploys a honeypot alongside an Elastic stack (Elasticsearch/Kibana) and ElastAlert, including a custom 'MITREAttack' alert that writes information according to the MITRE ATT&CK matrix for detecting and classifying attacks.
NetworkEndpointHoneypot
Open software—
Material reviewed: Repository documentationProof-of-concept tool that places breadcrumbs and decoys, such as fake files and credentials, on servers and workstations to draw attackers toward traps. It is not presented as a honeypot itself.
EndpointIdentityHoneytokenDecoy
Open software—
Material reviewed: Repository documentationA Windows tool that creates breadcrumbs and honeytokens, such as fake credentials in Windows Credential Manager, to lead attackers toward honeypots.
EndpointIdentityHoneytokenDecoy
Open software—
Material reviewed: Repository documentationPowerShell script that listens on specified TCP ports, logs incoming connections, and optionally blocks suspicious IP addresses via Windows Firewall, with whitelist support and detailed logging.
EndpointNetworkHoneypot
Open software—
Material reviewed: Repository documentationExtensible SSH honeypot written in Go using crypto/ssh to accept connections and log failed login attempts, including usernames and passwords. It supports dropping process privileges and includes a Lua-based plugin engine to process captured information, plus a virtual filesystem to more convincingly emulate a system.
NetworkEndpointHoneypot
Open software—
Material reviewed: Repository documentationkippo-extra is a set of additional fake commands (gcc, iptables, netstat, etc.) for the Kippo SSH honeypot, intended to make attacker sessions more realistic.
NetworkEndpointHoneypotDecoy
Open software—
Material reviewed: Repository documentationA high-interaction client honeypot for Windows that, per its documentation, detects zero-day exploits and shellcodes in browsers and office applications using exploitation-stage detection methods rather than signatures, without infecting the system.
EndpointHoneypot
Open software—
Material reviewed: Repository documentationmehrai is a Docker-based honeypot whose purpose is catching Mirai binaries, using an Alpine Linux image to mimic an IoT device and monitoring the filesystem and processes to collect samples and submit them to the Viper API.
IoTEndpointHoneypot
Open software—
Material reviewed: Repository documentationAn experimental and incomplete alpha-stage program that tracks decoy ('honey pot') files with names, extensions, and paths likely to be encrypted by ransomware, killing processes that lock them when opened.
EndpointDecoy
Open software—
Material reviewed: Repository documentationStarC is a documented high-interaction client honeypot for traffic analysis of Drive-by Download attacks, orchestrating a vulnerable Windows VM alongside traffic capture tools such as Wireshark and Fiddler.
EndpointNetworkHoneypot
Open software—
Material reviewed: Repository documentationThug is a Python low-interaction honeyclient that mimics the behavior of a web browser to detect and emulate malicious content.
EndpointNetworkHoneypot
Open software—
Material reviewed: Repository documentationA tool for creating and preparing virtual machines for Cuckoo Sandbox. Its link to deception is preparing and cloaking those analysis environments; the documentation does not present it as a honeypot.
Endpoint
Open software—
Material reviewed: Repository documentationWetland is a high-interaction SSH honeypot written in Python that uses Docker containers to provide a real Linux environment, logging brute force attempts as well as attacker shell, SCP, SFTP, exec-command, and port-forwarding sessions.
NetworkEndpointHoneypot