SDF-DT01

Interaction Tripwire Monitoring

intermediateDetection Value: criticalCost: lowTime: 3-7 days🔗 Network Infrastructure

Description

Monitor all interactions with deception assets using network and host-level instrumentation. Every connection attempt, port scan response, and service interaction is captured and evaluated as a potential adversary engagement indicator.

Rationale

Interactions with declared deception assets warrant investigation because those assets should be absent from ordinary workflows. The resulting signal may be more focused than general production monitoring, but its confidence depends on placement, access controls, authorized testing, and the possibility of accidental contact. The operational task is to capture, contextualize, and route interactions promptly.

Supporting Basis

Direct antecedent

The sources treat interaction with a non-production deception resource as an event that warrants alerting and investigation.

These sources establish design lineage and scope. They do not validate this record's operational effectiveness, planning estimates, environment labels, or ATT&CK relationships.

Implementation Steps

Deploy network monitoring

Install network flow monitoring and packet capture on all deception network segments. Capture both metadata and full packet content for high-value interactions.

Configure host-level logging

Enable comprehensive host logging on all deception assets: system calls, process creation, file access, network connections, and authentication events.

Set up real-time alerting

Create alert rules that trigger on any interaction with deception assets. Classify alerts by interaction type and potential severity.

Establish alert routing

Route deception alerts to SOC analysts with appropriate priority. Include enrichment context: which deception asset was contacted, what service was queried, and from what source.

Technical Implementation Examples(2)

Sigma Rule - Honeypot Interaction Detection

Sigma detection rule that alerts on any network connection to known deception asset IP addresses

yaml

# sigma/rules/shadow-cdf/honeypot-interaction.yml
title: Connection to ShadowMatrix CDF Deception Asset
id: f8a3b2c1-d4e5-4f67-8901-234567890abc
status: stable
description: >
  Detects any network connection to a known ShadowMatrix CDF deception asset.
  Any interaction with these assets is inherently suspicious as they
  have no legitimate purpose in the environment.
references:
  - https://shadow-cdf-matrix.internal/technique/SDF-DT01
author: ShadowMatrix CDF
date: 2026/03/28
tags:
  - attack.discovery
  - attack.lateral_movement
  - shadow_cdf.deception

logsource:
  category: firewall
  # Also works with: network_connection, proxy

detection:
  deception_hosts:
    dst_ip:
      - '10.200.10.20'   # prod-app-srv-07 (decoy)
      - '10.200.30.10'   # prod-db-04 (decoy)
      - '10.200.30.11'   # prod-db-04-replica (decoy)
      - '10.200.40.10'   # admin-portal (decoy)
      - '10.200.10.30'   # fileserver-finance (decoy)
      - '10.200.10.40'   # backup-nas-02 (decoy)
      - '10.200.40.20'   # monitoring-int (decoy)
      - '10.200.20.10'   # deploy-srv (decoy)

  # Exclude known legitimate monitoring that touches these IPs
  filter_monitoring:
    src_ip:
      - '10.200.99.10'   # ShadowMatrix CDF management host
      - '10.200.99.11'   # Log collector
  filter_health_checks:
    dst_port: 9100        # Prometheus node_exporter health checks

  condition: deception_hosts and not filter_monitoring
             and not filter_health_checks

falsepositives:
  - Network scanners that have not been excluded
  - Misconfigured monitoring tools
level: high

# Custom fields for SIEM enrichment
fields:
  - src_ip
  - dst_ip
  - dst_port
  - action
  - user

Wazuh Custom Rule - Deception Host SSH Access

Wazuh detection rule for SSH authentication attempts on deception hosts

xml

<!-- /var/ossec/etc/rules/shadow-cdf-deception.xml -->
<!-- Custom Wazuh rules for ShadowMatrix CDF deception asset monitoring -->

<group name="shadow_cdf,deception,">

  <!-- Base rule: any authentication event on a deception host -->
  <rule id="100100" level="12">
    <if_group>authentication_success|authentication_failed</if_group>
    <match>deception-hosts</match>
    <description>
      [ShadowMatrix CDF] Authentication attempt on deception host.
      Any authentication to a deception asset indicates adversary
      activity or credential misuse.
    </description>
    <group>shadow_cdf,deception,high_priority,</group>
    <options>alert_by_email</options>
  </rule>

  <!-- SSH login attempt to deception host -->
  <rule id="100101" level="14">
    <if_sid>5710,5711,5712,5716</if_sid>
    <hostname>prod-app-srv-07|prod-db-04|admin-jump-03</hostname>
    <description>
      [ShadowMatrix CDF] SSH access attempt on deception host $(hostname).
      Source: $(srcip). User: $(dstuser).
      CRITICAL: This host has no legitimate SSH users.
    </description>
    <group>shadow_cdf,deception,critical,</group>
    <options>alert_by_email</options>
  </rule>

  <!-- Successful SSH login to deception host -->
  <rule id="100102" level="15">
    <if_sid>5715</if_sid>
    <hostname>prod-app-srv-07|prod-db-04|admin-jump-03</hostname>
    <description>
      [ShadowMatrix CDF] SUCCESSFUL SSH LOGIN on deception host $(hostname).
      Source: $(srcip). User: $(dstuser).
      IMMEDIATE RESPONSE REQUIRED - adversary has access to decoy.
    </description>
    <group>shadow_cdf,deception,critical,incident,</group>
    <options>alert_by_email</options>
  </rule>

  <!-- Trap credential used (any host) -->
  <rule id="100110" level="15">
    <if_group>authentication_success|authentication_failed</if_group>
    <user>svc_sql_backup|svc_deploy_prod|r.nakamura|d.okafor</user>
    <description>
      [ShadowMatrix CDF] Trap credential used: $(dstuser) from $(srcip).
      These credentials exist only as traps - any usage indicates
      credential harvesting by an adversary.
    </description>
    <group>shadow_cdf,deception,credential_trap,critical,</group>
    <options>alert_by_email</options>
  </rule>

  <!-- File access on deception host (from FIM/syscheck) -->
  <rule id="100120" level="10">
    <if_sid>550,553,554</if_sid>
    <hostname>prod-app-srv-07|prod-db-04</hostname>
    <description>
      [ShadowMatrix CDF] File modification detected on deception host
      $(hostname): $(file).
      Adversary may be accessing trap files or deploying tools.
    </description>
    <group>shadow_cdf,deception,file_access,</group>
  </rule>

</group>

MITRE ATT&CK Mappings

Technique	Tactic	Relationship
T1046Network Service Discovery	Discovery	detects
T1021Remote Services	Lateral Movement	detects

Considerations

Legitimate network scanners and monitoring tools may inadvertently touch deception assets. Create allowlists for known internal scanners to prevent alert fatigue.
Capture enough context for analysts to make rapid triage decisions. An alert that says "connection to honeypot" is less useful than one that says "SSH connection from 10.5.3.42 to honeypot decoy-db-01 with credentials svc_backup".
Consider the volume. Automated scanning tools can generate thousands of interactions quickly. Ensure your alerting system can handle burst volumes without dropping events.

Supported Environments

🏢On-Premise

☁Amazon Web Services

☁Microsoft Azure

☁Google Cloud Platform

🔄Hybrid Environment

🏭OT/ICS Environment

Tools & Resources

SIEM platforms (Wazuh, Elastic Security, Splunk)
Network monitoring (Zeek, Suricata)
Host-based agents
Alert routing platforms

Related Techniques

SDF-PR06Monitoring Pipeline Setup

SDF-DT02Canary Alert Processing

Quick Stats

Phase: Detect
Difficulty: intermediate
Detection Value: critical
Cost: low
Time: 3-7 days
ATT&CK Mappings: 2