domains / families / security / deploying-honeytokens-and-canarytokens

deploying-honeytokens-and-canarytokens

separate

Plants Canarytokens-based decoy artifacts (honey credentials, DNS tokens, web-bug URLs, AWS keys, documents, kubeconfigs) using Thinkst's open-source Canarytokens project and alerts via email or webhook when a token is touched. Use for high-fidelity intrusion detection in low-telemetry areas like file shares or credential stores, or to catch credential dumping and data-theft staging.

When to use

• When you need high-fidelity intrusion detection in segments where traditional telemetry is sparse (file shares, password vaults, code repos, cloud accounts).
• When validating that an attacker who reaches a "crown-jewel" host or document store is detected, not just blocked at the perimeter.
• When seeding decoy credentials into LSASS-reachable memory, browser stores, `.aws/credentials`, or password managers to catch credential dumping and reuse.
• When instrumenting documents, repos, or wikis to catch data theft and ransomware staging.
• When building a MITRE D3FEND-aligned deception layer as part of a defense-in-depth or zero-trust program.

When not to use

• deploying tokens on infrastructure you do not own or administer
• using tokens to entrap third parties

Skill page

Source