Deploy the FortiDeceptor Token Package
A FortiDeceptor Token Package is used to add breadcrumbs on real endpoints and lure an attacker to a Decoy VM. Tokens are normally distributed within the real endpoints and other IT assets on the network to maximize the deception surface.
|
The saved view is associated with the administrator login and will remain saved, including after logging in and out, until the view is reset. |
To download and deploy a FortiDeceptor Token Package on an existing endpoint:
- Go to Deception > Decoy & Lure Status.
- Select the Decoy VM(s) by clicking the appropriate check boxes. The topmost check box will select all VMs.
- Click Download Package to download the FortiDeceptor Token Package. Packages can only be downloaded from Deceptions VMs with valid IPs. They must also be in one of the following statuses: Initialized, Stopped, Running, or Failed.
- Copy the FortiDeceptor Token Package to an endpoint (Windows or Linux).
- Unzip the FortiDeceptor Token Package:
- For Windows, copy the file under the Windows directory and execute the windows_token.exe by double-clicking the file.
- For Ubuntu, open Terminal and execute python ./ubuntu_token.py.
Once the FortiDeceptor Token Package is installed on a real Windows or Ubuntu endpoint, it increases the deception surface and lures the attacker to a Decoy VM.
To uninstall a FortiDeceptor Token Package:
- Go to Deception > Decoy & Lure Status.
- Select the Decoy VM.
- Click Download Package to download the FortiDeceptor Token Package.
- Copy the FortiDeceptor Token Package to the endpoint (Windows or Linux).
- Unzip the FortiDeceptor Token Package:
- For Windows, copy the file under the Windows directory and execute the uninstall.exe by double-clicking the file.
- For Ubuntu, open Terminal and execute ubuntu/uninstall.py.