Welcome to the Deception Layer

I build deception into environments for a living. Honeytokens, decoy hosts, fake credentials, believable file shares — the quiet machinery that makes an intruder reveal themselves before they reach anything that matters.

This is where I write it down: what works, what fails loudly, and what only looks clever in a slide deck.

What you'll find here

• Build logs — decoys and honeytokens I've deployed, and the telemetry they produced.
• Theorycrafting notes — demonstrating real engagement behaviour that differs from tabletop assumptions through research and expirementation.
• Tooling — small scripts, open source tools, and patterns that make deception maintainable at scale.

The one rule I keep coming back to

A decoy that no legitimate user ever touches produces a signal with almost no noise. That is the entire value proposition, and it is also the hardest part to preserve as an environment grows or is already quite large but is something to always strive for and target.

# A honeytoken is only useful if nothing legitimate can reach it.
LEGIT_SERVICE_ACCOUNTS = {"svc-backup", "svc-index"}

def is_high_confidence_alert(event) -> bool:
    if event.principal in LEGIT_SERVICE_ACCOUNTS:
        return False  # a real process wandered in: fix the decoy, not the alert
    return event.resource.startswith("decoy://")
def is_medium_confidence_alert(event) -> bool:
  # TODO: Medium Confidence Alert Event Handling
  raise NotImplementedError("Stay tuned...")

If you want new posts in your inbox, there's a subscribe box below. Otherwise the RSS feed has everything.