8.5.2. Sandboxing, Honeypots, and Deception Technology
💡 First Principle: Deception inverts the defensive model — instead of trying to keep attackers out (prevention) or spotting them in legitimate traffic (detection), you plant fake assets that have zero legitimate reason to be accessed. Any interaction with a honeypot is, by definition, unauthorized — eliminating the false-positive problem that plagues traditional detection. A single alert from a honeypot has extremely high fidelity because no legitimate user or process should ever touch it.
Sandboxing:
Sandboxes execute suspicious files or URLs in isolated, instrumented environments to observe behavior without risking production systems. Email security gateways detonate attachments in sandboxes before delivering to inboxes. Endpoint security submits unknown executables to cloud sandboxes for analysis.
| Sandbox Type | Use Case | Limitation |
|---|---|---|
| Email gateway sandbox | Detonate attachments before delivery | Delayed delivery; sandbox-aware malware may behave normally |
| Network sandbox | Analyze files downloaded from web | Cannot analyze encrypted payloads without TLS inspection |
| Endpoint sandbox | Isolate and analyze suspicious processes | Resource-intensive on endpoint; latency impact |
Sandbox evasion: Sophisticated malware detects sandbox environments (checks for VM artifacts, low memory, lack of user activity, short uptime) and behaves benignly until it reaches a real system. Counter-measures: make sandboxes more realistic (adequate RAM, simulated user activity, realistic uptime counters).
Honeypots and honeynets:
| Type | Complexity | Purpose | Risk |
|---|---|---|---|
| Low-interaction honeypot | Simulates limited services (open port, banner) | Early warning; attacker enumeration | Minimal — limited attack surface |
| High-interaction honeypot | Full OS and services | Detailed attacker TTP capture | Higher — attacker may use as pivot point |
| Honeynet | Network of honeypots simulating production environment | Full attack lifecycle observation | Significant — requires strong containment |
Canary tokens and deception technology:
Modern deception goes beyond traditional honeypots. Canary tokens are embedded in documents, credentials, DNS records, or database entries that should never be legitimately accessed:
- Honey credentials — Fake admin accounts in Active Directory. Any authentication attempt triggers an immediate high-fidelity alert.
- Honey files — Documents named "passwords.xlsx" or "executive-salaries.csv" placed on file shares. Any access triggers alert.
- Honey DNS records — Internal DNS entries pointing to monitored systems. Resolution attempts indicate internal reconnaissance.
Further malware and campaign types the exam distinguishes:
| Type | Defining Trait | Why It Matters |
|---|---|---|
| Logic bomb | Dormant code that fires when a condition is met (a date, an account being deleted) | Does not self-replicate, unlike a virus or worm; often planted by insiders |
| Rootkit | Subverts the OS or kernel, hooking the system calls that list processes, files and connections | The OS's own tools report a clean system — detect with memory forensics or offline/boot-time scans, or rebuild from known-good media |
| Fileless malware | Runs in memory through legitimate tools (PowerShell, WMI, mshta, certutil — "living off the land") | Nothing on disk for signature AV to scan — detect behaviourally, e.g., Word spawning PowerShell that opens an outbound connection |
An APT is a campaign, not a malware type: days of reconnaissance before slow, selective lateral movement, living-off-the-land tooling, and C2 blended into business-hours HTTPS — the opposite of opportunistic malware that hits every reachable system within minutes.
Endpoint Detection and Response (EDR):
EDR agents on endpoints provide continuous monitoring of process execution, file system changes, registry modifications, and network connections. Unlike traditional antivirus (signature-based, file-focused), EDR captures behavioral telemetry that enables:
- Detection of fileless malware (PowerShell-based attacks, living-off-the-land binaries)
- Post-compromise investigation (full process tree, timeline of attacker activity)
- Remote containment (isolate compromised endpoint from network while maintaining management connection)
Malware types: a virus attaches to a host file and needs user execution to spread; a worm self-replicates across networks without user interaction; a Trojan masquerades as legitimate software; a rootkit hides at the OS or kernel level to evade detection.
Anti-malware defense layers:
| Layer | Technology | What It Catches |
|---|---|---|
| Email gateway | Spam filtering, attachment sandboxing, URL rewriting | Phishing, malicious attachments |
| Web proxy | URL categorization, content inspection, download scanning | Drive-by downloads, malicious sites |
| Endpoint | EDR, next-gen AV, host-based IPS | Malware execution, fileless attacks |
| Network | IPS, sandbox, DNS filtering | Lateral movement, C2 communications |
Layering against lookalike domains: phishing campaigns register fresh typosquatted domains, so IOC blocklists always lag. Combine controls at several points instead — quarantine mail from newly registered domains at the email gateway, enable lookalike-domain (typosquat/homoglyph) detection, and alert in the SIEM when internal hosts resolve newly registered domains.
⚠️ Exam Trap: Honeypots must be placed carefully — a honeypot on an external network segment detects external threats but provides no visibility into insider activity. A honeypot on an internal segment detects lateral movement and insider threats. Placement should match the threat model. Additionally, any data collected by honeypots about attackers may have legal implications depending on jurisdiction.
Reflection Question: Your SOC has high alert volume from the IDS/IPS and SIEM but low confidence in alert fidelity — analysts spend most of their time investigating false positives. The CISO asks you to propose a detection architecture improvement. Describe how you would integrate deception technology (honeypots and canary tokens) into the existing architecture, where you would place them, and what specific high-fidelity alerts they would produce that your current detection stack cannot.
