Open software2025
Material reviewed: Repository metadataEditor contributionExperimental framework generating fictitious user profiles and activity for decoy environments; the repository documents narratives, profiles and language-model integration.
EndpointNetworkDecoyAdversary engagement
Open software2024
Material reviewed: Repository metadataEditor contributionOpen framework for planning deception operations and deploying decoys and services with Python and Docker, according to its repository and documentation.
NetworkApplicationDecoyHoneypot
Open software—
Material reviewed: Repository documentationSSH tarpit that slowly sends an endless banner to tie up connecting SSH clients while the real SSH server uses another port.
NetworkAdversary engagementDecoy
Open software—
Material reviewed: Repository documentationA Splunk app that analyzes JSON logs from the Cowrie SSH honeypot to provide dashboards and metrics on attacker engagement, aiming to observe behavioral changes when honeypot configuration settings are adjusted.
NetworkHoneypotAdversary engagement
Open software—
Material reviewed: Repository documentationRuby on Rails gem plugin documenting honey traps and configurable responses to detect and respond to malicious behavior in an application.
ApplicationDecoyAdversary engagement
Open software—
Material reviewed: Repository documentationMedium-interaction SSH honeypot that simulates users and a shell to observe attacker commands; it documents downloading requested files to a separate directory for analysis.
NetworkHoneypotDecoy
Open software—
Material reviewed: Repository documentationHoneypot for detecting and interacting with web application exploitation attempts. Its documentation describes backend-managed sensors and static, scripted, or AI-assisted responses.
ApplicationHoneypotAdversary engagement
Open software—
Material reviewed: Repository documentationFraud-detection tool that receives attempted calls and SIP probes, recording source IPs and dialed numbers for alerts and lookup. Its deception link is allowing and observing those attempts.
NetworkAdversary engagement
Open software—
Material reviewed: Repository documentationModified OpenSSH daemon that forwards commands to Cowrie to interpret interactions and log brute-force attacks and SSH sessions.
NetworkHoneypotAdversary engagement
Open software—
Material reviewed: Repository documentationGo-based SSH honeypot with a fake shell and virtual filesystem; its documentation describes session recording, SFTP/SCP transfers, and JSON activity logs.
NetworkHoneypotAdversary engagement