d3fend-deceive

Original：🇺🇸 English

Translated

Guides cybersecurity deception operations using MITRE D3FEND—honeynets, decoy objects, decoy personas, and decoy credentials. Covers honeypot deployment, decoy file planting, credential baiting, and deception environment design. Use when deploying honeypots, planting decoy data, baiting credentials, or designing deception programs—not for detection (d3fend-detect), hardening (d3fend-harden), or isolation (d3fend-isolate).

2installs

Sourcedaemon-blockint-tech/agentic-enteprises-skill

Added on2026-05-20

NPX Install

npx skill4agent add daemon-blockint-tech/agentic-enteprises-skill d3fend-deceive

SKILL.md Content

View Translation Comparison →

D3FEND — Deceive

When to Use

Deploying honeynets (connected, integrated, standalone)
Planting decoy objects (files, network resources, personas)
Distributing decoy credentials and session tokens
Publishing decoy information (fake releases, personas)
Designing deception programs and adversary engagement
Monitoring deception environment for adversary interaction

When NOT to Use

Building detection rules or SIEM content →
```
d3fend-detect
```
System hardening or secure config →
```
d3fend-harden
```
Network segmentation →
```
d3fend-isolate
```
Active defense / threat intel →
```
cybersecurity
```
Adversarial testing (red team) →
```
ai-redteam
```
/
```
offensive-security-analyst
```

Core Workflows

1. Decoy Environments (Honeynets)

Type	Deployment	Use Case
Standalone	Isolated network segment	Research, early warning
Integrated	Blended with production	Insider threat, lateral movement
Connected	Linked to real systems	APT detection, TTP collection

See
references/honeynets.md

2. Decoy Objects

Decoy files: Fake documents with tracking (canary tokens)
Decoy network resources: Fake shares, databases, services
Decoy personas: Fake user accounts with believable data
Decoy public releases: Fake credentials on dark web/pastebin
Decoy session tokens: Bait cookies/API keys with monitoring

See
references/decoy_objects.md

3. Deception Program Design

Define objectives (detection, delay, intelligence)
Select deception layers (environment, object, persona)
Ensure believability and consistency
Monitor and collect adversary TTPs
Analyze and feed into threat intelligence

See
references/deception_program.md

When to load references

Honeynets →
```
references/honeynets.md
```
Decoy objects →
```
references/decoy_objects.md
```
Deception program →
```
references/deception_program.md
```