Open software—
Material reviewed: Repository documentationA Windows tool that creates breadcrumbs and honeytokens, such as fake credentials in Windows Credential Manager, to lead attackers toward honeypots.
EndpointIdentityHoneytokenDecoy
Open software—
Material reviewed: Repository documentationPowerShell script that listens on specified TCP ports, logs incoming connections, and optionally blocks suspicious IP addresses via Windows Firewall, with whitelist support and detailed logging.
EndpointNetworkHoneypot
Framework or guide—
Material reviewed: Repository documentationhoneypot_recipes is a Chef cookbook that automates deployment of activity-monitoring tools (Sysdig and Falco) on Linux systems to support high-interaction honeypots, capturing and logging system calls. The tools themselves are monitoring infrastructure, not a honeypot: they provide logging and detection support used alongside a high-interaction honeypot.
NetworkEndpoint
Open software—
Material reviewed: Repository documentationExtensible SSH honeypot written in Go using crypto/ssh to accept connections and log failed login attempts, including usernames and passwords. It supports dropping process privileges and includes a Lua-based plugin engine to process captured information, plus a virtual filesystem to more convincingly emulate a system.
NetworkEndpointHoneypot
Product—
Material reviewed: Public pageAn InnerWarden enterprise offering that, according to the vendor page, simulates a filesystem and Linux commands to interact with attackers. It is separate from the open-source innerwarden guardrail.
EndpointHoneypot
Open software—
Material reviewed: Repository documentationkippo-extra is a set of additional fake commands (gcc, iptables, netstat, etc.) for the Kippo SSH honeypot, intended to make attacker sessions more realistic.
NetworkEndpointHoneypotDecoy
Open software—
Material reviewed: Repository documentationA high-interaction client honeypot for Windows that, per its documentation, detects zero-day exploits and shellcodes in browsers and office applications using exploitation-stage detection methods rather than signatures, without infecting the system.
EndpointHoneypot
Open software—
Material reviewed: Repository documentationmehrai is a Docker-based honeypot whose purpose is catching Mirai binaries, using an Alpine Linux image to mimic an IoT device and monitoring the filesystem and processes to collect samples and submit them to the Viper API.
IoTEndpointHoneypot
Product—
Material reviewed: Public pageCritical readingCommercial identity protection component deploying endpoint deceptions to alert on lateral movement, according to Proofpoint.
EndpointIdentityDecoyHoneytoken
Open software—
Material reviewed: Repository documentationAn experimental and incomplete alpha-stage program that tracks decoy ('honey pot') files with names, extensions, and paths likely to be encrypted by ransomware, killing processes that lock them when opened.
EndpointDecoy
Open software—
Material reviewed: Repository documentationStarC is a documented high-interaction client honeypot for traffic analysis of Drive-by Download attacks, orchestrating a vulnerable Windows VM alongside traffic capture tools such as Wireshark and Fiddler.
EndpointNetworkHoneypot
Open software—
Material reviewed: Repository documentationThug is a Python low-interaction honeyclient that mimics the behavior of a web browser to detect and emulate malicious content.
EndpointNetworkHoneypot
Open software—
Material reviewed: Repository documentationA tool for creating and preparing virtual machines for Cuckoo Sandbox. Its link to deception is preparing and cloaking those analysis environments; the documentation does not present it as a honeypot.
Endpoint
Open software—
Material reviewed: Repository documentationWetland is a high-interaction SSH honeypot written in Python that uses Docker containers to provide a real Linux environment, logging brute force attempts as well as attacker shell, SCP, SFTP, exec-command, and port-forwarding sessions.
NetworkEndpointHoneypot