@chrissanders88@infosec.exchange
2026-09-18 14:15 UTC
They’re low effort. They require very little tuning. And because legitimate users have no reason to interact with them, they can produce incredibly high-confidence alerts with very few false positives.
The idea is simple: put something in your environment that nobody should touch, make it interesting to an attacker, and pay very close attention when somebody touches it. If you can control what an attacker sees and thinks, you can control what they do and find them.
Replies (1)
-
@chrissanders88@infosec.exchange 2026-09-18 14:15
CISA’s report makes it clear that these techniques are valuable, especially when attackers use legitimate credentials and tools that make malicious activity harder to distinguish from normal behavior. If you want to actually implement these ideas, I wrote the book Intrusion Detection Honeypots specifically around this philosophy. I also have a hands-on course that walks through designing and deploying IDHs in real environments.