Decoy · Application
HashiCorp Vault decoy
A secrets manager holds the keys to everything else. This decoy poses as vault-prod01, an unsealed Vault 1.17 server with its UI, health check and API.
What it emulates
Poses as: HashiCorp Vault secrets manager.
It records every login, every token check and every attempt to read a secret, generate cloud keys or database passwords, or change policies.
- SSH 22
Records every password, key and username tried, then refuses them. Only a password Kandaro planted opens a fake shell, where every command is recorded and answered with made-up output. Nothing runs.
- Vault 8200
The Vault UI and API. Records logins, token lookups and every attempt to read secrets, request cloud or database credentials, or change policies and audit settings. Every request is refused.
What it catches
Every touch, explained in plain English.
Each event gets a plain-English explanation. Related events from the same source become one incident with a recommended action.
- Logins by username and password or LDAP
- Stolen tokens being checked or used
- Attempts to read stored secrets
- Requests for cloud keys, database passwords or certificates
- Attempts to change policies, sign-in methods or audit logging
MITRE ATT&CK
Techniques come from a fixed table, not from AI, so the same activity always maps the same way.
- T1046Network Service Discovery
- T1059Command and Scripting Interpreter
- T1110Brute Force
- T1190Exploit Public-Facing Application
- T1552.001Unsecured Credentials: Credentials In Files
- T1552.005Unsecured Credentials: Cloud Instance Metadata API
Incidents go to email, Slack, your SIEM or a signed webhook. Kandaro and your SOC
Safe by design
Built to be attacked. Never a way in.
A decoy only listens and answers with fake data. It never runs code and only connects out to Kandaro, so it can never become a way into your network.
It runs nothing
The sensor has no way to run a command, load code or update itself. Every command an intruder types gets a fake text answer.
It connects to one place only
Its only outbound connection is HTTPS to the Kandaro API address set at install time. Nothing Kandaro sends can change that address.
Kandaro can only send it settings
Which decoy to imitate, which services to turn off, which addresses to ignore. There is no field for code, files, commands or updates.
It holds no real secrets
Passwords, keys and records it shows are fake. Its only credential is its own key, which can send events for your organisation and nothing more.
It cannot be used to attack others
It never forwards traffic, never fetches a URL and never serves scripts or programs. Its only UDP replies (SNMP) are rate-limited per address.
Non-root, read-only container with signed images. How we secure sensors
Where to put it
Place it where an intruder will look.
Put it next to your real secrets infrastructure, or anywhere a vault address appears in configs an intruder might read.
Installs in about a minute with Docker, Kubernetes, Ansible, a VM or a Raspberry Pi, and needs outbound HTTPS only. Deployment guide · Where to put your first decoys · What happens when attackers find your secrets manager
FAQ
HashiCorp Vault decoy questions
Does it hold any real secrets?
Can an attacker actually log in?
Is it safe to run on my network?
Related decoys
Pair it with these.
- app
Keycloak IAM
Keycloak identity server
A fake single sign-on server. Whoever controls it controls every account.
SSH 22Keycloak 8080 - app
Kubernetes API
Kubernetes control plane
A Kubernetes API server. Catches secret listing, pod exec and cluster mapping.
SSH 22Kubernetes API 6443 - app
Jenkins CI
Jenkins build server
A build server with credentials for every deploy target. Catches script console and credential access.
SSH 22Jenkins 8080
Put this decoy on your network today.
Start a 14-day trial of Kandaro Deception. Your first decoy is running in about a minute.
Card required · cancel before day 14 and pay nothing