Lion Cipher Lab
Deploy deception: honey accounts and bait files as internal tripwires
- SOC Analyst / Blue Team
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Most detection hunts for a needle in a haystack — a bad action hidden inside mountains of legitimate activity — which is why SOCs drown in false positives. Deception inverts the problem. You plant things a legitimate user has no reason to ever touch: a service account nobody should log into, a file called `passwords.kdbx` you will never open. Because the baseline is zero, a single interaction is not a maybe — it is a near-certain intruder. That is a high-fidelity alert: one that is almost never wrong, so humans never learn to ignore it. Doing this on your own box, end to end, teaches the…
What you'll learn
- Deception engineering on a live host
- Honey (decoy) user accounts
- Bait / decoy files as tripwires
- Linux auditd watch rules and audit keys
- Reading audit events with ausearch and aureport
- Honeytokens that phone home off-box
- Detection placement and alert-fatigue judgment
- MITRE Engage / D3FEND deception framing
Steps in this lab
- What deception engineering is — and how this differs from the last two labs
- The two rules that decide whether deception helps or hurts
- Install and confirm the audit daemon (auditd)
- Decoy #1 — plant a bait file and put a watch on it
- Trigger the file tripwire yourself, then read the event back
- Decoy #2 — create the honey account (D3FEND Decoy User Credential)
- Trigger the honey account, and confirm the auth attempt was logged
- Turn a log line into an actual page (wire the alert)
- Optional — make the bait phone home even off your box (an AWS honeytoken)
- Where decoys belong, when NOT to use them, and what you learned