HACKING PROJECT · network · Beginner
Honeypot Setup
Enable a student to deploy deception sensors that generate high-fidelity early-warning alerts and adversary intelligence.
Organizations often detect intrusions only after damage is done because they lack high-signal, low-noise early-warning sensors inside their environment. Production telemetry is noisy, while any interaction with a decoy is inherently suspicious. Without deception assets, defenders miss reconnaissance and lateral-movement activity that precedes a breach.
**What you'll build**
Deploy and instrument honeypots (Cowrie SSH/Telnet, Dionaea, or T-Pot) in a segmented network to lure and record attacker interactions, capturing credentials tried, commands run, and malware dropped. Centralize logs into an ELK dashboard, extract IOCs, and generate threat-intel from observed TTPs. The honeypot becomes an early-warning tripwire and a source of adversary intelligence mapped to MITRE ATT&CK.
**Objective** — Enable a student to deploy deception sensors that generate high-fidelity early-warning alerts and adversary intelligence.
**Expected outcome** — A running honeypot with an ELK dashboard capturing attacker sessions, plus an IOC/TTP threat-intel report mapped to MITRE ATT&CK.
**Difficulty** — Beginner — turnkey honeypots deploy easily, though log analysis and threat-intel extraction reach Intermediate.
**Primary category** — Deception Technology / SOC; Secondary = Threat Intelligence, Threat Hunting
**Security domains** — Primary = Blue Team; Secondary = Threat Intelligence, Threat Hunting, Incident Response, Purple Team, Malware Analysis
**Technical focus** — Deception/honeypots, SSH/Telnet emulation, attacker TTP capture, IOC extraction, ELK/SIEM dashboarding, network segmentation, malware collection, threat intel enrichment, log analysis
**Core technologies** — Languages: Python, Bash; Frameworks/Libraries: ELK/OpenSearch stack, Logstash pipelines; Security Tools: Cowrie, Dionaea, T-Pot, Suricata; Cloud/Infra: Docker, isolated VLAN/cloud VM, firewall segmentation; AI/Data: log analytics, optional clustering of attacker sessions; Databases: Elasticsearch
**Where it's valued** — MSSPs, finance, critical infrastructure, government, research, any enterprise SOC
**Careers it builds toward** — SOC Analyst, Threat Intelligence Analyst, Threat Hunter, Security Engineer, Incident Responder
**Framework alignment**
• MITRE ATT&CK: Reconnaissance — Active Scanning (T1595); Initial Access — Valid Accounts (T1078), Brute Force (T1110); Execution — Command and Scripting Interpreter (T1059); Credential Access via captured logins; MITRE D3FEND Decoy techniques (Decoy Environment/Session)
• NIST CSF 2.0: Detect (early warning, adverse event analysis), Identify (threat intel), Respond
• OWASP: N/A (network deception focus)
• CIS Controls v8: 13 (Network Monitoring and Defense), 8 (Audit Log Management), 12 (Network Infrastructure Management)
**Innovation** — Improved Existing Solution — honeypots are established, but centralized ELK analytics with automated MITRE-mapped threat-intel output raises the ceiling. Scores: Innovation 5/10, Startup 5/10, Enterprise-Readiness 6/10, Patent = No.