🏭 IoT/OT Protocol Honeypot

Modbus/S7Comm/BACnet honeypots for ICS/SCADA detection.

→ Explore in ATT&CK matrix (2 mappings) Deployment detail

What it is

Deploy honeypots that emulate industrial control system protocols (Modbus TCP, S7Comm, EtherNet/IP, BACnet). These attract attackers scanning for exposed SCADA/ICS infrastructure.

Implementation requirements

Conpot or custom protocol emulators for Modbus (port 502), S7Comm (port 102), BACnet (port 47808)
Realistic HMI (Human Machine Interface) web frontends
Network isolation: OT honeypots MUST NOT be reachable from real OT networks
Telemetry: All protocol interactions logged to SIEM with full packet capture
Rollback: Shut down the honeypot, release its address and remove its firewall exceptions.
Upkeep: Keep emulated device models and banners current. Monthly proof-of-life protocol query.

Technologies

Network

ATT&CK coverage 2

Technique	Tactic	Status	Confidence	Tier
T1018 Remote System Discovery	Discovery	confirmed	strong	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) A Virtual Honeypot Framework — Decoy hosts on unused addresses are found, and logged, by an attacker mapping the network. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1018 to its Lures activity.
T1046 Network Service Discovery	Discovery	confirmed	strong	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) A Virtual Honeypot Framework — Honeyd simulates hosts on unallocated addresses and deceives network scanning and fingerprinting tools. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1046 to its Lures activity. Koney: A Cyber Deception Orchestration Framework for Kubernetes — (D029) Koney uses service meshes and eBPF to add traps to containerised applications; probing a trap is logged.

Evidence

A Survey of Honeypots and Honeynets for Internet of Things, Industrial Internet of Things, and Cyber-Physical Systems — Franco, J.; Aris, A.; Canberk, B.; Uluagac, A. S., IEEE COMST 2021 peer-reviewed
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard

Research basis: J. Franco, A. Aris, B. Canberk, S. Uluagac, "A Survey of Honeypots and Honeynets for IoT, IIoT, and CPS" — IEEE Communications Surveys & Tutorials, 2021. Also: Conpot (Honeynet Project), GRFICSv2 (Georgia Tech).