How do they detect MS Word docs being opened?
But basically they would embed a remote image inside the file so it would call out to a web server upon loading the image. It also had the added benefit from a LEO perspective that if the users main defence was running TOR browser that it would bypass that and provide the users true IP address.
However, as I mentioned in another comment here, I actually think those particular kinds of honeypots are kind of dumb in that they only catch stupid adversaries.
Opening those files on your own machine as an attacker while connected to the net is one of those do not pass go, do not collect $200 go directly to jail moves.
It's enough to catch one guy, one time. Then you follow his physical or digital traces.
There’s even an argument that all you’ve done is tipped your hand to the adversary that deception is at play in this scenario and allow them to adjust their approach accordingly.
Not even suggesting that would be a horrible thing to happen, even in that scenario you most likely can at least slow them down but if you never know you’re being targeted in the first place it doesn’t matter too much when that clock starts.
The ideal scenario I think you should actually be aiming for here is to craft a situation where you know about them but they don’t know that you know. That’s a window of time where you very clearly have an upper hand.
That isn’t actually that hard to create. For example one technique I have at that really early stage is to return a 403 auth error on a web service and set a cookie that looks very natural to its environment but is also very obvious as to how you could change it in order to no longer get a 403 response.
The moment I get a request with that new cookie value I instantly know I have something I should be paying attention to and I know it’s a real person not a bot. The adversary however has no idea yet what’s going on, they just think they hit a gold mine.
As a defender, you only get to fail once for it to be costly. As an attacker, you can often fail hundreds or thousands of times depending on what they have for observability. Adding offensive elements helps level the playing field.
I have story after story after story of people who should have known better who got done for really silly shit.
I’m only making the argument here that that specific technique has some real limitations and known work arounds to the point that people actively know to look for it and that as a result I would personally look for other techniques that don’t have the same set of trade offs.