Deploy the FortiDeceptor token package

Use a FortiDeceptor token package to add breadcrumbs on real endpoints and lure an attacker to a Decoy VM. Tokens are normally distributed within real endpoints and other IT assets on the network to maximize the deception surface.

The following token types are available.

Token type	Description
SMB (hidden mapped network disk)	Map the shared directory to a remote decoy that acts as file server while the shared disk is hidden. The username and password are saved in the Windows Vault. SMB remote folders are Windows folders.
SAMBA (hidden mapped network disk)	Same as SMB but for Linux SAMBA shares. SAMBA remote folders are Linux folders.
RDP (Remote Desktop)	Create RDP shortcuts in %USERPROFILE%\Documents. The file name format is rdp_USERNAME_IP.rdp and created files are hidden. The RDP Lure username and password are saved in Windows Vault.
SSH (Secure Shell)	Create a hidden Putty shortcut in %USERPROFILE%\Documents. If Putty (putty.exe) is not installed in the specified directory, no shortcut is created.
ARP (neighbor entry)	Add a persistent neighbor ARP entry to the corresponding network interface.
Credential Cache Lure	In Domain environment, add a new cache entry to the real desktop or server process lsass.exe.

To download a FortiDeceptor token package:

1. Go to Deception > Decoy & Lure Status.
2. Select the Decoy VM by clicking its checkbox.
3. To download the FortiDeceptor token package, click Download Package.
   • You can only download packages with valid IP addresses.
   • A package must have a status of Initialized, Stopped, Running, or Failed.

To deploy or uninstall a FortiDeceptor token package on an existing endpoint:

1. Copy the downloaded FortiDeceptor token package to an endpoint such as a Windows or Linux endpoint.
2. Unzip the FortiDeceptor token package.
3. In the folder for the OS, such as windows or ubuntu, follow the instructions in README.txt to install or uninstall the token package.
   • For Windows, open the windows folder, right-click windows_token.exe and select Run as administrator.

     ARP lures must be installed with administrator permission.

   • For Ubuntu, open Terminal and run python ./ubuntu_token.py.

When the FortiDeceptor token package is installed on a real Windows or Ubuntu endpoint, it increases the deception surface and lures the attacker to a Decoy VM.