New to Claude Skills? Learn how to install them →

mukul975 on GitHub

Deception-Based Detection

Free

Enhance breach detection with Canary Tokens.

Get this skill

Free · Opens the source repo

What Deception-Based Detection does

This skill facilitates the deployment and monitoring of Canary Tokens using the Thinkst Canary REST API, providing a proactive approach to breach detection. Canary Tokens are lightweight mechanisms that alert users when an unauthorized access attempt is made on a resource. By programmatically creating various types of tokens, including web bugs, DNS tokens, MS Word documents, and AWS API keys, this skill enables users to strategically position these tokens throughout their environment to detect potential breaches early.

The skill streamlines the process of setting up these tokens and monitoring their activity. Users can authenticate to the Canary Console API, create the tokens, and track their trigger history. Additionally, it generates detailed deception coverage reports, which include deployment recommendations and a map showing token types across network segments. This functionality is particularly useful for security professionals looking to enhance their security architecture and compliance posture.

Ideal for security assessments and ongoing monitoring, this skill is designed for environments where early breach detection is critical. By using Canary Tokens, organizations can establish an additional layer of security that alerts them to suspicious activities before they escalate into significant incidents. This proactive approach not only aids in compliance with security standards but also helps in fortifying the overall security framework.

Overall, this skill is a valuable tool for developers and security engineers aiming to implement deception-based detection mechanisms effectively and efficiently, ensuring they stay ahead of potential threats.

When to use it

Use this skill when deploying Canary Tokens for breach detection in your security environment.

When not to use it

This skill may not be suitable for environments without a Thinkst Canary account or where Python is not supported.

What you can build with it

Setting Up Early Warning Systems

Deploy Canary Tokens in strategic locations to receive alerts on unauthorized access attempts.

Enhancing Security Compliance

Utilize the skill to align your security controls with compliance requirements through effective token management.

Conducting Security Assessments

Implement this skill during security assessments to evaluate and improve your existing security architecture.

How to install Deception-Based Detection

View source

1. Install with the skills CLI

npx skills add mukul975/anthropic-cybersecurity-skills/implementing-deception-based-detection-with-canarytoken --agent claude-code

2. Or install it manually

Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.

Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs

Inside SKILL.md

Written by mukul975

Implementing Deception-Based Detection with Canarytoken

Overview

Canary Tokens are lightweight tripwire mechanisms that alert when an attacker accesses a resource. This skill uses the Thinkst Canary REST API to programmatically create tokens (web bugs, DNS tokens, MS Word documents, AWS API keys), deploy them to strategic locations, monitor for triggered alerts, and generate deception coverage reports.

When to Use

  • When deploying or configuring implementing deception based detection with canarytoken capabilities in your environment
  • When establishing security controls aligned to compliance requirements
  • When building or improving security architecture for this domain
  • When conducting security assessments that require this implementation

Prerequisites

  • Thinkst Canary Console or canarytokens.org account
  • API auth token from Canary Console
  • Python 3.9+ with requests
  • File system access for deploying document and file tokens

Steps

  1. Authenticate to the Canary Console API using auth_token
  2. Create web bug (HTTP) tokens for embedding in documents and web pages
  3. Create DNS tokens for monitoring DNS resolution attempts
  4. Create MS Word document tokens for file share deployment
  5. List all active tokens and their trigger history
  6. Query recent alerts for triggered token events
  7. Generate deception coverage report with deployment recommendations

Expected Output

  • JSON report listing all deployed Canary Tokens, trigger history, alert details, and coverage analysis
  • Deployment map showing token types across network segments

Frequently asked questions about Deception-Based Detection

Similar skills