Lion Cipher Lab
Deploy canary tokens to catch an intruder
- SOC Analyst / Blue Team
- Beginner
- ~45 min
- Free · no account required
Why it matters
Most detection tries to spot a bad thing hidden in a mountain of normal activity, which is why security teams drown in false alarms. A canary token flips that: it is a file, a link or a hostname that has no legitimate reason to ever be touched, so if it is touched, something is wrong — nearly no guesswork, nearly no false positives. That is why deception is one of the highest-signal, lowest-cost detections a defender can deploy, and why it works just as well on your own laptop as in a corporate network. Doing it once, end to end, teaches you the whole detection-engineering loop in under an…
What you'll learn
- Deception engineering
- Canary tokens / honeytokens
- Building tripwire detections
- Reading and triaging an alert
- DNS and HTTP fundamentals
- Detection engineering mindset
Steps in this lab
- First, what a canary token actually is
- The one rule: your own stuff, only
- Set up the one thing that matters: where the alert lands
- Token 1 — a URL that should never be clicked (the web bug / HTTP token)
- Trigger it on purpose, and watch the alert arrive
- Token 2 — a hostname that should never be looked up (the DNS token)
- Read the alert like an analyst — including what it cannot tell you
- Token 3 — a decoy document that begs to be opened
- Token 4 (Windows only) — a folder that alerts when someone browses it
- Where to actually put these on a real machine
- What a real detection would look like — and what to do with it
- What you actually learned here