hacklcx/HFish
HFish
HFish is a distributed honeypot system and network intrusion detection tool designed to deploy decoy services and nodes to detect and analyze attacker behavior. It functions as a deceptive asset orchestrator that simulates enterprise services and configures custom baits to lure network intruders.
The system utilizes a server-client architecture to manage distributed nodes across different platforms, allowing for centralized control of telemetry collection and decoy deployment. It incorporates cloud-based traffic routing to redirect suspicious network activity into managed decoy environments for centralized threat capture and analysis.
The platform provides capabilities for network scanning detection across open ports and the simulation of various network services, including IoT devices and CRM systems. It includes a threat telemetry manager and a pluggable alert dispatcher that routes security notifications through email, webhooks, syslog, and enterprise messaging platforms.
Features
- Honeypot Management - Provides a comprehensive platform for deploying and controlling multiple decoy nodes from a centralized server.
- Honeypots and Deception - Deploys decoy services and nodes to detect and analyze attacker behavior across a distributed network.
- Deceptive Service Mocks - Emulates specific network protocols and services, such as IoT devices and CRM systems, to mislead attackers.
- Scanning Detection - Tracks activity across all open network ports to identify reconnaissance and unauthorized scanning patterns.
- Network Scanning Detection - Tracks network ports to identify reconnaissance activities and alert on unauthorized scanning attempts.
- Deceptive Asset Orchestrators - Functions as an orchestrator for configuring custom baits and simulating enterprise services to lure intruders.
- Deceptive Bait Configurations - Provides a way to define specific asset profiles and deceptive settings to lure network intruders.
- Honeypot Node Management - Controls remote telemetry collection points via a centralized server that coordinates deployment and data gathering.
- Network Deception Technologies - Creates fake network services and assets to lure attackers and detect unauthorized activity.
- Network Intrusion Detection - Monitors network traffic for suspicious patterns and reconnaissance attempts to alert administrators of potential intrusions.
- Threat Telemetry Collection - Collects interaction data from remote nodes using a server-client architecture to manage threat telemetry.
- Web Honeypots - Builds specialized web-based deceptive environments to lure attackers and capture interaction data.
- Traffic Routing - Implements mechanisms for directing suspicious network traffic to isolated decoy environments for centralized analysis.
- Decoy Redirections - Provides cloud-based traffic routing to redirect suspicious activity into managed decoy environments for centralized analysis.
- Threat Notification Systems - Sends real-time security notifications to administrators via webhooks, email, or messaging platforms.
- Notification Dispatchers - Dispatches threat alerts via email, syslog, webhooks, and enterprise messaging platforms.
- Distributed Node Lifecycles - Manages the deployment and supervision of remote decoy nodes across different platforms.
- Multi-Channel Alerting - Routes security notifications through multiple external channels including email, webhooks, and enterprise messaging systems.
- Honeypots - Deploys high-interaction honeypots for threat intelligence.
