Deploy the FortiDeceptor token package

Use a FortiDeceptor token package to add breadcrumbs on real endpoints and lure an attacker to a Decoy VM. Tokens are normally distributed within real endpoints and other IT assets on the network to maximize the deception surface.

The following token types are available.

Token type	Description
SMB (hidden mapped network disk)	Map the shared directory to a remote decoy that acts as file server while the shared disk is hidden. The username and password are saved in the Windows Vault (Credentials Manager). SMB remote folders are Windows folders.
SAMBA (hidden mapped network disk)	Same as SMB but for Linux SAMBA shares. SAMBA remote folders are Linux folders.
RDP (Remote Desktop)	The username, password and the windows Decoy IP are saved in the Windows Vault (Credentials Manager). Additionally, it creates RDP shortcuts in %USERPROFILE%\Documents. The file name format is rdp_USERNAME_IP.rdp and created files are hidden. The RDP Lure username and password are saved in Windows Vault.
SSH (Secure Shell)	Create a hidden Putty shortcut in %USERPROFILE%\Documents. If Putty (putty.exe) is not installed in the specified directory, no shortcut is created.
ARP (neighbor entry)	Add a persistent neighbor ARP entry to the corresponding network interface.
Credential Cache Lure	In Domain environment, add a new credentials entry to the real desktop or server process lsass.exe.
HoneyDocs	Add fake files (Word & PDF) to Windows directories. The default is to the most recent folder. You can specify the location in the Windows directory.
ODBC	The ODBC lure saves a DSN connection string using the Trusted Connection mechanism. To deploy an effective ODBC token, the following is required: Deploy with domain DNS and SQL SERVER service based on a custom windows image joining a domain. See, Customize Decoy VMs > To deploy decoys with custom images–SQL Server. Install ODBC lures into domain user accounts that are on the same domain as the custom Windows server.
SAP token	Add fake SAP configuration files to Windows SAP installation path that contains decoy IP and other SAP related configuration data.

To download a FortiDeceptor token package:

1. Go to Deception > Decoy & Lure Status.
2. Select the Decoy VM by clicking its checkbox.
3. To download the FortiDeceptor token package, click Download Package.

   

   You can only download packages with valid IP addresses. A package must have a status of Initialized, Stopped, Running, or Failed. We recommend downloading a package with a status of Running.

To deploy or uninstall a FortiDeceptor token package on an existing endpoint:

We recommended \you uninstall previous tokens before installing the new version tokens by following the uninstall instructions below.

Install visual c++ 2015 redistributable package before installing the tokens on Windows 7. For more information, seeDeploying tokens using AD GPO logon script.

1. Copy the downloaded FortiDeceptor token package to an endpoint such as a Windows or Linux endpoint.
2. Unzip the FortiDeceptor token package.
3. In the folder for the OS, such as windows or ubuntu, follow the instructions in README.txt to install the token package.
   • For Windows: Open the windows folder, and click the windows_token.exe to run it. ARP lures must be installed with administrator permission.
   • For Ubuntu: Open Terminal and run python ./ubuntu_token.py.
4. In the folder for the OS, such as windows or ubuntu, uninstall the token package.

   • For Windows: Open the windows folder, delete the res folder and double-click uninstall.bat to run it. ARP lures must be uninstalled with administrator permission.

   • For Ubuntu: Open Terminal, delete the res folder and run python ./uninstall.py.

When the FortiDeceptor token package is installed on a real Windows or Ubuntu endpoint, it increases the deception attack surface and lures the attacker to a Decoy VM.