Lion Cipher Lab
Catch an intruder with honeyfiles: a decoy no one should ever open
- SOC Analyst / Blue Team
- Intermediate
- Free · no account required
Why it matters
Most detection is noisy: you write a rule, it fires on real work and attacks alike, and analysts burn out triaging maybes. A honeyfile inverts that. Because you place a decoy that no real user, script, or backup job ever needs to open, a read of it is not 'suspicious' — it is a person who went hunting through your box. That makes it one of the highest-fidelity, lowest-false-positive signals a defender can build for almost no cost. Attackers and malicious insiders both enumerate a host looking for secrets — credentials, key files, payroll — so a well-named decoy sitting exactly where they'd…
What you'll learn
- Deception-based detection
- auditd file watches (auditctl)
- Investigating with ausearch and aureport
- Attribution with auid vs uid
- Building high-fidelity, low-false-positive alerts
Steps in this lab
- The idea: deception as detection, not decoration
- Confirm auditd is installed and running
- Prove the 'before': read the file, get nothing
- Set the trap: one auditd watch on the decoy
- Make it permanent (survive a reboot)
- Spring it: simulate an intruder reading the decoy
- The 'after': find exactly who, what, and when
- When, why, better — and the honest limits