
Deception-Based Detection
FreeEnhance breach detection with Canary Tokens.
Free · Opens the source repo
What Deception-Based Detection does
This skill facilitates the deployment and monitoring of Canary Tokens using the Thinkst Canary REST API, providing a proactive approach to breach detection. Canary Tokens are lightweight mechanisms that alert users when an unauthorized access attempt is made on a resource. By programmatically creating various types of tokens, including web bugs, DNS tokens, MS Word documents, and AWS API keys, this skill enables users to strategically position these tokens throughout their environment to detect potential breaches early.
The skill streamlines the process of setting up these tokens and monitoring their activity. Users can authenticate to the Canary Console API, create the tokens, and track their trigger history. Additionally, it generates detailed deception coverage reports, which include deployment recommendations and a map showing token types across network segments. This functionality is particularly useful for security professionals looking to enhance their security architecture and compliance posture.
Ideal for security assessments and ongoing monitoring, this skill is designed for environments where early breach detection is critical. By using Canary Tokens, organizations can establish an additional layer of security that alerts them to suspicious activities before they escalate into significant incidents. This proactive approach not only aids in compliance with security standards but also helps in fortifying the overall security framework.
Overall, this skill is a valuable tool for developers and security engineers aiming to implement deception-based detection mechanisms effectively and efficiently, ensuring they stay ahead of potential threats.
When to use it
Use this skill when deploying Canary Tokens for breach detection in your security environment.
When not to use it
This skill may not be suitable for environments without a Thinkst Canary account or where Python is not supported.
What you can build with it
Setting Up Early Warning Systems
Deploy Canary Tokens in strategic locations to receive alerts on unauthorized access attempts.
Enhancing Security Compliance
Utilize the skill to align your security controls with compliance requirements through effective token management.
Conducting Security Assessments
Implement this skill during security assessments to evaluate and improve your existing security architecture.
How to install Deception-Based Detection
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/implementing-deception-based-detection-with-canarytoken --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Implementing Deception-Based Detection with Canarytoken
Overview
Canary Tokens are lightweight tripwire mechanisms that alert when an attacker accesses a resource. This skill uses the Thinkst Canary REST API to programmatically create tokens (web bugs, DNS tokens, MS Word documents, AWS API keys), deploy them to strategic locations, monitor for triggered alerts, and generate deception coverage reports.
When to Use
- When deploying or configuring implementing deception based detection with canarytoken capabilities in your environment
- When establishing security controls aligned to compliance requirements
- When building or improving security architecture for this domain
- When conducting security assessments that require this implementation
Prerequisites
- Thinkst Canary Console or canarytokens.org account
- API auth token from Canary Console
- Python 3.9+ with
requests - File system access for deploying document and file tokens
Steps
- Authenticate to the Canary Console API using auth_token
- Create web bug (HTTP) tokens for embedding in documents and web pages
- Create DNS tokens for monitoring DNS resolution attempts
- Create MS Word document tokens for file share deployment
- List all active tokens and their trigger history
- Query recent alerts for triggered token events
- Generate deception coverage report with deployment recommendations
Expected Output
- JSON report listing all deployed Canary Tokens, trigger history, alert details, and coverage analysis
- Deployment map showing token types across network segments
Frequently asked questions about Deception-Based Detection
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.
