Fortinet black logo

Administration Guide

Home FortiDeceptor 4.0.0 Administration Guide

Deploy the FortiDeceptor token package

4.0.0
5.3.0
5.2.0
5.1.0
5.0.0
4.3.0
4.2.0
4.1.1
4.1.0
4.0.2
4.0.1
4.0.0
3.3.3
3.3.2
3.3.1
3.3.0
3.2.2
3.2.1
3.2.0
3.1.1
3.1.0
3.0.2
3.0.1
3.0.0
2.1.0
2.0.0
1.1.0
1.0.1
Copy Link
Copy Doc ID 730dcfd9-f176-11eb-97f7-00505692583a:782334
Download PDF

Deploy the FortiDeceptor token package

Use a FortiDeceptor token package to add breadcrumbs on real endpoints and lure an attacker to a Decoy VM. Tokens are normally distributed within real endpoints and other IT assets on the network to maximize the deception surface.

The following token types are available.

Token type Description

SMB (hidden mapped network disk)

Map the shared directory to a remote decoy that acts as file server while the shared disk is hidden. The username and password are saved in the Windows Vault (Credentials Manager).

SMB remote folders are Windows folders.

SAMBA (hidden mapped network disk)

Same as SMB but for Linux SAMBA shares. SAMBA remote folders are Linux folders.

RDP (Remote Desktop)

The username, password and the windows Decoy IP are saved in the Windows Vault (Credentials Manager).

Additionally, it creates RDP shortcuts in %USERPROFILE%\Documents. The file name format is rdp_USERNAME_IP.rdp and created files are hidden.

The RDP Lure username and password are saved in Windows Vault.

SSH (Secure Shell)

Create a hidden Putty shortcut in %USERPROFILE%\Documents.

If Putty (putty.exe) is not installed in the specified directory, no shortcut is created.

ARP (neighbor entry)

Add a persistent neighbor ARP entry to the corresponding network interface.

Credential Cache Lure

In Domain environment, add a new credentials entry to the real desktop or server process lsass.exe.

HoneyDocs

Add fake files (word & PDF) to windows directories like recent documents and more. End-users can specify the location in the windows directory.
To download a FortiDeceptor token package:
  1. Go to Deception > Decoy & Lure Status.
  2. Select the Decoy VM by clicking its checkbox.
  3. To download the FortiDeceptor token package, click Download Package.
    • You can only download packages with valid IP addresses.
    • A package must have a status of Initialized, Stopped, Running, or Failed.
To deploy or uninstall a FortiDeceptor token package on an existing endpoint:
  1. Copy the downloaded FortiDeceptor token package to an endpoint such as a Windows or Linux endpoint.
  2. Unzip the FortiDeceptor token package.
  3. In the folder for the OS, such as windows or ubuntu, follow the instructions in README.txt to install or uninstall the token package.
    • For Windows, open the windows folder, and click the windows_token.exe to run it.

      ARP lures must be installed with administrator permission.

    • For Ubuntu, open Terminal and run python ./ubuntu_token.py.

When the FortiDeceptor token package is installed on a real Windows or Ubuntu endpoint, it increases the deception surface and lures the attacker to a Decoy VM.

Previous
Next

Deploy the FortiDeceptor token package

Use a FortiDeceptor token package to add breadcrumbs on real endpoints and lure an attacker to a Decoy VM. Tokens are normally distributed within real endpoints and other IT assets on the network to maximize the deception surface.

The following token types are available.

Token type Description

SMB (hidden mapped network disk)

Map the shared directory to a remote decoy that acts as file server while the shared disk is hidden. The username and password are saved in the Windows Vault (Credentials Manager).

SMB remote folders are Windows folders.

SAMBA (hidden mapped network disk)

Same as SMB but for Linux SAMBA shares. SAMBA remote folders are Linux folders.

RDP (Remote Desktop)

The username, password and the windows Decoy IP are saved in the Windows Vault (Credentials Manager).

Additionally, it creates RDP shortcuts in %USERPROFILE%\Documents. The file name format is rdp_USERNAME_IP.rdp and created files are hidden.

The RDP Lure username and password are saved in Windows Vault.

SSH (Secure Shell)

Create a hidden Putty shortcut in %USERPROFILE%\Documents.

If Putty (putty.exe) is not installed in the specified directory, no shortcut is created.

ARP (neighbor entry)

Add a persistent neighbor ARP entry to the corresponding network interface.

Credential Cache Lure

In Domain environment, add a new credentials entry to the real desktop or server process lsass.exe.

HoneyDocs

Add fake files (word & PDF) to windows directories like recent documents and more. End-users can specify the location in the windows directory.
To download a FortiDeceptor token package:
  1. Go to Deception > Decoy & Lure Status.
  2. Select the Decoy VM by clicking its checkbox.
  3. To download the FortiDeceptor token package, click Download Package.
    • You can only download packages with valid IP addresses.
    • A package must have a status of Initialized, Stopped, Running, or Failed.
To deploy or uninstall a FortiDeceptor token package on an existing endpoint:
  1. Copy the downloaded FortiDeceptor token package to an endpoint such as a Windows or Linux endpoint.
  2. Unzip the FortiDeceptor token package.
  3. In the folder for the OS, such as windows or ubuntu, follow the instructions in README.txt to install or uninstall the token package.
    • For Windows, open the windows folder, and click the windows_token.exe to run it.

      ARP lures must be installed with administrator permission.

    • For Ubuntu, open Terminal and run python ./ubuntu_token.py.

When the FortiDeceptor token package is installed on a real Windows or Ubuntu endpoint, it increases the deception surface and lures the attacker to a Decoy VM.

Previous
Next