Information Security Building Alloy Secure – Stronger Together

In the evolving landscape of cybersecurity, detecting malicious activity early is crucial. A powerful approach involves deploying honeyfiles—decoy files designed to attract attackers and trigger alerts upon access. This method reduces attacker dwell time and enhances detection capabilities without relying on complex ACL rules or requiring files to be opened by native applications.

You Should Know:

1. Windows Honeyfiles with ETW

Velociraptor’s `Windows.Detection.Honeyfiles` artifact leverages Event Tracing for Windows (ETW) to monitor access to decoy files. Below is a sample configuration:

name: Windows.Detection.Honeyfiles
description: |
Deploys and monitors honeyfiles using ETW for high-fidelity alerts.
parameters:
- name: HoneyfilePath
default: C:\honeyfiles\fake_secret.txt
- name: MonitorEvents
default: True
sources:
- precondition: SELECT OS FROM info() WHERE OS = 'windows'
queries:
- SELECT * FROM ETW(
providers=["Microsoft-Windows-Kernel-File"],
event_types=["FileCreate","FileDelete","FileRename","FileRead"])
WHERE TargetFilename =~ HoneyfilePath

**Steps to Deploy:**

1. Create a fake sensitive file:

echo "Confidential Data (FAKE)" > C:\honeyfiles\fake_secret.txt

2. Apply restrictive permissions to make it enticing:

icacls C:\honeyfiles\fake_secret.txt /deny "Everyone:(R)"

3. Deploy the Velociraptor artifact and monitor events.

#### **2. Linux Honeyfiles with eBPF**

For Linux, Velociraptor’s eBPF plugin tracks file access. Example artifact:

name: Linux.Detection.Honeyfiles
description: |
Uses eBPF to monitor honeyfile access on Linux systems.
parameters:
- name: HoneyfilePath
default: /var/honeyfiles/fake_db.sql
sources:
- precondition: SELECT OS FROM info() WHERE OS = 'linux'
queries:
- SELECT * FROM eBPF(
program="tracepoint/file/file_access",
filter="path == HoneyfilePath")

**Steps to Deploy:**

1. Create a decoy file:

echo "Fake Database Credentials" > /var/honeyfiles/fake_db.sql

2. Set restrictive permissions:

chmod 600 /var/honeyfiles/fake_db.sql
chown root:root /var/honeyfiles/fake_db.sql

3. Deploy the Velociraptor artifact and watch for access attempts.

### **What Undercode Say**

Honeyfiles are a low-cost, high-reward defensive tactic. By combining them with modern monitoring tools like Velociraptor, defenders gain an early warning system against intruders. Key takeaways:
– Windows: Use ETW for real-time file monitoring.
– Linux: Leverage eBPF for kernel-level visibility.
– Cross-Platform: Velociraptor unifies detection across environments.

Additional defensive commands:

• Windows:

  </li>
  </ul>
  
  <h1>Log all file accesses in a directory</h1>
  
  Get-WinEvent -LogName "Microsoft-Windows-Kernel-File/Operational" | Where-Object { $_.Message -like "*C:\honeyfiles*" }
  

  – Linux:

  
  <h1>Audit file access via auditd</h1>
  
  sudo auditctl -w /var/honeyfiles/ -p war -k honeyfile_monitor
  

  **Expected Output:**

  [Velociraptor Alert] Honeyfile accessed: /var/honeyfiles/fake_db.sql 
  User: attacker PID: 1234 
  

  For more details, visit: Velociraptor Honeyfiles Documentation.

  References:

  Reported By: Activity 7310806089304866816 – Hackers Feeds
  Extra Hub: Undercode MoN
  Basic Verification: Pass ✅

  Join Our Cyber World:

  💬 Whatsapp | 💬 Telegram