Skip to content
Kandaro
Start free trial

Decoy · Device

Windows file server decoy

Ransomware operators go after file servers first: that is where the shares are. This decoy poses as FS01, a Windows file server in corp.local, with file sharing, Remote Desktop, SQL Server, an IIS intranet and FTP.

Start free trialAll decoys

What it emulates

Poses as: Windows file server.

It also catches a classic trick. Every so often it asks the network for a server name that does not exist. A real network stays quiet; an attacker running a poisoning tool answers, and that answer is the alert.

  • SMB 445

    Answers the Windows file-sharing handshake and records the username, domain and computer name of whoever tries to sign in, then refuses. There are no shares to open.

  • NetBIOS 139

    The older NetBIOS route into the same file-sharing service. Records the same sign-in details.

  • RPC 135

    Accepts the connection and records the first bytes sent. It does not speak the protocol yet.

  • RDP 3389

    Answers the Remote Desktop handshake and records the username the client sends. Never shows a desktop.

  • SQL Server 1433

    Speaks SQL Server 2019. Records the username and the password sent, or the Windows account details, then answers "Login failed".

  • HTTP 80

    An IIS "Company Intranet" sign-in page that records every username and password. Intranet pages are an endless, slowly served maze.

  • LLMNR 5355/udp

    Asks the network for a made-up server name and never answers anyone else. Whoever replies is running a poisoning tool.

  • NetBIOS names 137/udp

    The same check over NetBIOS name lookups.

  • FTP 21

    Records every username and password tried and every command sent. Never lets anyone in.

What it catches

Every touch, explained in plain English.

Each event gets a plain-English explanation. Related events from the same source become one incident with a recommended action.

  • Windows sign-ins against the file shares, with user, domain and computer name
  • Remote Desktop connection attempts and the username used
  • SQL Server logins, including the password sent
  • LLMNR and NetBIOS poisoning tools such as Responder
  • Password guessing on the intranet and FTP
  • Port scans across the server

MITRE ATT&CK

Techniques come from a fixed table, not from AI, so the same activity always maps the same way.

  • T1046Network Service Discovery
  • T1059Command and Scripting Interpreter
  • T1110Brute Force
  • T1190Exploit Public-Facing Application
  • T1552.001Unsecured Credentials: Credentials In Files
  • T1552.005Unsecured Credentials: Cloud Instance Metadata API
  • T1557.001Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay

Incidents go to email, Slack, your SIEM or a signed webhook. Kandaro and your SOC

Safe by design

Built to be attacked. Never a way in.

A decoy only listens and answers with fake data. It never runs code and only connects out to Kandaro, so it can never become a way into your network.

  • It runs nothing

    The sensor has no way to run a command, load code or update itself. Every command an intruder types gets a fake text answer.

  • It connects to one place only

    Its only outbound connection is HTTPS to the Kandaro API address set at install time. Nothing Kandaro sends can change that address.

  • Kandaro can only send it settings

    Which decoy to imitate, which services to turn off, which addresses to ignore. There is no field for code, files, commands or updates.

  • It holds no real secrets

    Passwords, keys and records it shows are fake. Its only credential is its own key, which can send events for your organisation and nothing more.

  • It cannot be used to attack others

    It never forwards traffic, never fetches a URL and never serves scripts or programs. Its only UDP replies (SNMP) are rate-limited per address.

Non-root, read-only container with signed images. How we secure sensors

Where to put it

Place it where an intruder will look.

Put it in the same network as your real file servers or user workstations, where a share-hunting intruder or a poisoning tool will see it.

Installs in about a minute with Docker, Kubernetes, Ansible, a VM or a Raspberry Pi, and needs outbound HTTPS only. Deployment guide · Where to put your first decoys · How attackers map your network before you notice

FAQ

Windows file server decoy questions

What is LLMNR poisoning and why does this catch it?
Windows asks the local network for names it cannot look up. Attack tools answer those questions to steal passwords. The decoy asks for a name nobody owns, so only an attack tool would ever answer.
Are there any real shares on it?
No. The decoy refuses every sign-in, so there is nothing to open, copy or encrypt.
Is it safe to run on my network?
Yes. A decoy only answers connections with fake data. It runs nothing, forwards nothing and only connects out to the Kandaro API over HTTPS. It runs as an unprivileged, read-only container.

Related decoys

Pair it with these.

Put this decoy on your network today.

Start a 14-day trial of Kandaro Deception. Your first decoy is running in about a minute.

Start free trialView packages

Card required · cancel before day 14 and pay nothing