SDF-PR03

Service Emulation Engineering

intermediateDetection Value: highCost: lowTime: 1-2 weeks⚙ Applications & Services

Description

Develop or deploy service emulations that mimic real production services at a level of fidelity appropriate for the target adversary profile. This ranges from simple port listeners to fully interactive service emulations.

Rationale

Adversaries interact with services, not just hosts. A decoy server running SSH, HTTP, and SMB that responds realistically to standard queries will hold adversary attention longer than an empty host with open ports. Service emulation bridges the gap between basic honeypots and fully instrumented deception environments.

Supporting Basis

Literature-informed design

Honeypot literature and the Active Deception Framework support emulated deceptive services; this engineering record and its prescribed fields are a ShadowMatrix formulation.

These sources establish design lineage and scope. They do not validate this record's operational effectiveness, planning estimates, environment labels, or ATT&CK relationships.

Implementation Steps

Inventory production services

Document all services running in production, including versions, configurations, and response behaviors that need to be emulated.

Select emulation approach

Choose between real service instances (highest fidelity), open-source honeypot services (medium fidelity), or custom protocol emulators (lowest overhead).

Deploy and configure services

Install and configure selected services on decoy hosts. Ensure version strings, banners, and response headers match production.

Add interaction depth

For high-priority services, add realistic content behind the service. A decoy web application should have pages, a decoy database should have tables and records.

Test service realism

Use the same scanning and enumeration tools adversaries would use to verify that services present a realistic profile.

Technical Implementation Examples(2)

Multi-Service Honeypot with Docker Compose

Docker Compose configuration deploying multiple emulated services (SSH, HTTP, FTP, SMB) on a single decoy host

yaml

# docker-compose.yml - Multi-service decoy deployment
version: "3.8"

services:
  # SSH Honeypot (Cowrie)
  cowrie-ssh:
    image: cowrie/cowrie:latest
    container_name: decoy-ssh
    restart: unless-stopped
    ports:
      - "22:2222"
    volumes:
      - ./cowrie/cowrie.cfg:/cowrie/cowrie-git/etc/cowrie.cfg:ro
      - cowrie_logs:/cowrie/cowrie-git/var/log/cowrie
      - cowrie_dl:/cowrie/cowrie-git/var/lib/cowrie/downloads
    environment:
      - COWRIE_TELNET_ENABLED=false
    logging:
      driver: "json-file"
      options:
        max-size: "50m"
        max-file: "5"

  # HTTP Decoy Web Application
  decoy-web:
    build:
      context: ./decoy-webapp
      dockerfile: Dockerfile
    container_name: decoy-web
    restart: unless-stopped
    ports:
      - "80:8080"
      - "443:8443"
    volumes:
      - ./decoy-webapp/html:/usr/share/nginx/html:ro
      - web_logs:/var/log/nginx
    environment:
      - SERVER_NAME=intranet.corp.internal

  # FTP Honeypot (Dionaea)
  dionaea-ftp:
    image: dinotools/dionaea:latest
    container_name: decoy-ftp
    restart: unless-stopped
    ports:
      - "21:21"
      - "69:69/udp"
    volumes:
      - dionaea_logs:/opt/dionaea/var/log
      - dionaea_binaries:/opt/dionaea/var/lib/dionaea/binaries

  # SMB Honeypot
  decoy-smb:
    image: impacket-smbserver:local
    build:
      context: ./decoy-smb
    container_name: decoy-smb
    restart: unless-stopped
    ports:
      - "445:445"
      - "139:139"
    volumes:
      - ./decoy-smb/shares:/srv/shares:ro
      - smb_logs:/var/log/samba

  # Log aggregation (ships to central SIEM)
  filebeat:
    image: docker.elastic.co/beats/filebeat:8.12.0
    container_name: shadow-filebeat
    restart: unless-stopped
    user: root
    volumes:
      - ./filebeat/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro
      - cowrie_logs:/var/log/cowrie:ro
      - web_logs:/var/log/nginx:ro
      - dionaea_logs:/var/log/dionaea:ro
      - smb_logs:/var/log/samba:ro
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
    environment:
      - ELASTICSEARCH_HOSTS=${SIEM_HOST}
      - ELASTICSEARCH_API_KEY=${SIEM_API_KEY}

volumes:
  cowrie_logs:
  cowrie_dl:
  web_logs:
  dionaea_logs:
  dionaea_binaries:
  smb_logs:

Cowrie SSH Honeypot Configuration

Configuration file for Cowrie SSH honeypot with production-matching banner and realistic filesystem

ini

# cowrie/cowrie.cfg - SSH Honeypot Configuration
[honeypot]
hostname = prod-app-srv-07
log_path = var/log/cowrie
download_path = var/lib/cowrie/downloads
# Allow interaction for intelligence gathering
interactive_timeout = 300

[ssh]
enabled = true
# Match the SSH version string of your production servers
version = SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.6
listen_endpoints = tcp:2222:interface=0.0.0.0

[telnet]
enabled = false

[output_jsonlog]
enabled = true
logfile = var/log/cowrie/cowrie.json

# Forward logs to SIEM via syslog
[output_syslog]
enabled = true
facility = LOCAL5
# Send to central log collector
host = 10.200.99.10
port = 5514

# Realistic filesystem based on Ubuntu 22.04
[shell]
filesystem = share/cowrie/fs.pickle
kernel_version = 5.15.0-91-generic
kernel_build_string = #101-Ubuntu SMP Tue Nov 14 13:30:08 UTC 2023
hardware_platform = x86_64
os_name = GNU/Linux
os_version = #101-Ubuntu SMP

# Fake process list
[processes]
enabled = true

# Accept specific fake credentials (trap credentials from SDF-DP03)
[userdb]
# Format: username:uid:password
# These match credentials planted in production config files
auth_class = UserDB
contents = [
    {"username": "app_svc_prod", "password": "Pr0d-Db#2026!xK9m"},
    {"username": "sysadmin", "password": "Winter2026!"},
    {"username": "j.martinez", "password": "DevOps#123"},
    {"username": "root", "password": "*"}
  ]

MITRE ATT&CK Mappings

Technique	Tactic	Relationship
T1046Network Service Discovery	Discovery	counters
T1190Exploit Public-Facing Application	Initial Access	detects

Considerations

Service version strings are one of the first things adversaries check. Ensure they match your production environment.
High-interaction services that allow actual command execution provide richer intelligence but require stronger isolation.
Some adversaries will test services with known exploits. Decide in advance whether your emulated services should appear vulnerable or patched.

Supported Environments

🏢On-Premise

☁Amazon Web Services

☁Microsoft Azure

☁Google Cloud Platform

🔄Hybrid Environment

🏭OT/ICS Environment

Tools & Resources

Cowrie (SSH/Telnet honeypot)
Dionaea (multi-protocol honeypot)
Conpot (ICS/SCADA honeypot)
HoneyDB, T-Pot (honeypot platforms)
Real service installations with hardened configurations

Related Techniques

SDF-PR02Decoy Host Fabrication

SDF-DP04Decoy Service Activation

Quick Stats

Phase: Prepare
Difficulty: intermediate
Detection Value: high
Cost: low
Time: 1-2 weeks
ATT&CK Mappings: 2