Plant a honeytoken and watch it fire

short · 45 min · Objective 4.3

Task

Place three honeytokens in your lab, use one, and confirm the detection is immediate and unambiguous -- which is the property that makes them the best value in this domain.

Steps

  1. Create three honeytokens of different kinds: a credential in a configuration file no service reads, a decoy record in a data store, and a DNS name nothing should resolve. Record them in lab/honeytokens.csv as token,kind,location,detection_path.
  2. For each, build the detection path: what log records its use, and what rule fires.
  3. Use each token -- authenticate with the credential, query the decoy record, resolve the name -- and capture all three alerts in lab/honeytoken-alerts.txt.
  4. Run for a period with no use and record the false positive count. It should be zero, and if it is not, the token is in a path something legitimately touches.
  5. Write lab/honeytoken-note.md on why these fire AFTER other controls have failed, and what that makes them worth compared with their cost.

Verify

awk -F, 'NR>1 {n++} END {print n" honeytoken(s)"}' lab/honeytokens.csv
grep -c . lab/honeytoken-alerts.txt
grep -Ec '0' lab/honeytoken-note.md
grep -Eci 'after|already failed|legitimate' lab/honeytoken-note.md

Three tokens, three alerts captured, and a zero false positive count recorded. Any use is suspicious by construction, which is why this is one of the few detections that still works when the attacker is behaving legitimately in every other respect.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.