FortiDeceptor decoys

• Windows 7
• Windows 10 (can be deployed as a gold image)
• Windows 2016 (deployed as a gold image)
• Windows 2019 (deployed as a gold image)

• Ubuntu Desktop

• SCADA version 3
• Medical OS
• POS OS
• ERP OS
• 8 OT protocols
• IoT OS

• RDP
• SMB
• TCPListener
• NBNSSpoofSpotter

• SSH
• SAMBA

• TCPListener

• HTTP

• HTTPS

• GIT

• HTTP
• FTP
• TFTP
• SNMP
• MODBUS
• S7COMM
• BACNET
• IPMI
• TRICONEX
• ENIP
• Kamstrup

• DNP3

• Telnet

• PACS-WEB
• PACS
• DICOM server
• Infusion Pump (TELNET)
• Infusion Pump (FTP)
• POS-WEB
• ERP-WEP
• GUARDIAN-AST
• IEC104

• Jetdirect

• Printer-WEB

• IP Camera-WEB

• UPnP

• RTSP

• CDP

• Enable this towill open port 161 on decoy VM, and respond to SNMP(v1 or v2c) request from within network

• Community name is user-defined

• SNMP response is customized for HP printer decoy

• Enable this service will open port 9100 on decoy VM, and respond to PJL (Printer Job Language) request.

• A web GUI that simulate administration GUI of HP Officejet Pro X451dw printer.

• A login-required service that displays videos to simulate IP cameras, although there are default videos, users should upload 1-8 .mp4 videos to best fit the working environment.

• Enable this service to open port 161 on decoy VM, and respond to SNMP(v1 or v2c) request from within the network

• Community name is user-defined

• SNMP response is customized for IP camera decoy

• Enable this service to open port 8080 on decoy VM and simulate UPnP service: a UPnP msg will broadcast within the network. Within the msg there is a url for the attacker to download a .xml file showing device information.

• When this this service is enabled, you will also need to upload a video to a predefined location so the attacker can watch the video.

• The RTSP port can be adjusted

• To upload, you can use ffmpeg, or any other methods to infinitely loop a video, so it is available to the attacker

For example, to infinitely loop a video:sudo ffmpeg -re -stream_loop -1 -i {path_to_local_video} -c copy -f rtsp rtsp://{ip}:{port}/{name_you_choose};

For attacker, the live camera stream is available at rtsp://{ip}:{port}/{name_you_choose}

4 cisco images (model) are supported - 2691, 3660, 3725 and 3745, also if users upload a cisco image that cannot be used, an error msg will appear.

User can upload a customized cisco config file to predefine the Cisco router setting

• A login-required service that enables attackers to utilize all Cisco router’s functions.

• A login-required GUI service that like the telnet service but provide less functionalities.

• Enable this service to open port 161 on decoy VM, and respond to SNMP(v1 or v2c) request from within the network.

• Community name is user-defined.

• SNMP response is customized for Cisco router decoy

• Simulate Infusion Pump (telnet)

• A username/password is required to login.

• Simulates Infusion Pump (FTP)

• A username/password is required to login.

• A user-defined name for the PACS system.

• Login-required web GUI for PACS, with existing medical data

• Port can be adjusted

• Enable this service to open port 161 on decoy VM, and respond to SNMP(v1 or v2c) request from within the network

• Community name is user-defined

• SNMP response is customized for Schneider SCADAPack 333E decoy

• Toggle to enable/disable this service, enable this service capture attack through DNP3

• Login-required telnet service simulates SCADAPack E Smart RTU command line environment

• Enable this service to open port 161 on decoy VM, and respond to SNMP(v1 or v2c) requests from within the network

• Community name is user-defined

• SNMP response is customized for Schneider Power Meter - PM5560 decoy

• Toggle to enable/disable this service. Enable this service to capture attacks through BACNET on default BACNET port

• Toggle to enable/disable this service. Enable this service to capture attacks through HTTP on default HTTP port

• toggle to enable/disable this service, enable this service capture attack through DNP3 on default DNP3 port

• Toggle to enable/disable this service. Enable this service to capture attacks through ENIP on default ENIP port

• Enable this service to open port 161 on decoy VM, and respond to SNMP(v1 or v2c) request from within the network

• SNMP response is customized for Schneider EcoStruxure BMS server decoy

• Community name is user-defined

• Toggle to enable/disable this service. Enable this service tp capture attacks through BACNET on default BACNET port

• Toggle to enable/disable this service. Enable this service to capture attacks through HTTP on default HTTP port

• Toggle to enable/disable this service, enable this service capture attack to TRICONEX service

• Toggle to enable/disable this service. Enable this service capture attack through HTTP on default HTTP port

• HTTP page title is user defined

• Plant Identification is user-defined

• Serial Number is user-defined

• Toggle to enable/disable this service. Enable this to service capture attacks through TFTP on default TFTP port

• Enable this service to open port 161 on decoy VM, and respond to SNMP(v1 or v2c) request from within the network

• SNMP response is customized for Siemens S7-200 PLC decoy

• Community name is user-defined

• Toggle to enable/disable this service. Enable this service capture attack through MODBUS on default MODBUS port

• Toggle to enable/disable this service. Enable this service capture attack through S7COMM on default S7COMM port

• Module Type is user-defined

• PLC Name is user-defined

• Toggle to enable/disable this service, enable this service capture attack through HTTP on default HTTP port

• HTTP page title is user defined

• Toggle to enable/disable this service. Enable this service to capture attacks through TFTP on default TFTP port

• Enable this service to open port 161 on decoy VM, and respond to SNMP(v1 or v2c) request from within the network

• SNMP response is customized for Siemens Rockwell PLC decoy

• Community name is user-defined

• Toggle to enable/disable this service, enable this service capture attack through ENIP on default ENIP port

• ENIP serial number is user-defined

• Toggle to enable/disable this service. Enable this service to capture attacks through TFTP on the default TFTP port

• Enable this service to open port 161 on decoy VM, and respond to SNMP(v1 or v2c) request from within the network

• SNMP response is customized for Siemens S7-300 PLC decoy

• Community name is user-defined

• Toggle to enable/disable this service, enable this service capture attack through IEC104 on default IEC104 port

• Toggle to enable/disable this service. Enable this service to capture attacks through HTTP on default HTTP port

• Enable this service to open port 161 on decoy VM, and respond to SNMP(v1 or v2c) request from within the network

• SNMP response is customized for IPMI Device decoy

• community name is user-defined

• Toggle to enable/disable this service. Enable this service to capture attack through FTP on default FTP port

• FTP banner is user-defined

• toggle to enable/disable this service, enable this service capture attack through IPMI on default IPMI port

• Toggle to enable/disable this service. Enable this service to simulate a Kamstrup device

• To deploy a KAMSTRUP decoy, this service must be enabled since it is the only service available

• Enable this service to open port 161 on decoy VM, and respond to SNMP(v1 or v2c) request from within the network

• SNMP response is customized for VAV-DD BACnet controller decoy

• Community name is user-defined

• Toggle to enable/disable this service. Enable this service capture attack through BACNET on default BACNET port

• Toggle to enable/disable this service. Enable this service to simulate a AST’s satellite communications remote asset tracking system named Guardian

• To deploy a Guardian-AST decoy, this service must be enabled since it is the only service available

• Toggle to enable/disable this service. Enable this service to capture attacks through HTTP on default HTTP port

• Toggle to enable/disable this service. Enable this service capture attack through FTP on default FTP port

• FTP banner is user-defined

• Enable this service to open port 161 on decoy VM, and respond to SNMP(v1 or v2c) request from within the network

• SNMP response is customized for Ascent Compass MNG decoy

• Community name is user-defined