Great post. Honeypots behind the firewall are also a great way to pick up lateral movement and privilege escalation.

There's a ton of useful open-source tooling one can play with in the space. Here's a list:

- https://www.smokescreen.io/practical-honeypots-a-list-of-ope...

Most of the projects are also small enough that you can easily contribute back to them especially in terms of reducing the ability to fingerprint the honeypots.

Somewhat timely, The Grugq just wrote up a nice article on Counterintelligence for Cyber Defence:

- https://medium.com/@thegrugq/counterintelligence-for-cyber-d...