Troje

Troje is a honeypot solution that creates realistic environments within physical or virtual machines using LXC containers. The tool dynamically generates containers upon the first connection attempt to desired services like SSH, establishing an interactive environment for attackers to engage with.

The system operates by intercepting and passing all network traffic between the service and the attacker's connection, while simultaneously monitoring all activities within the LXC container environment. Troje records changes made to the container's file system and drives, providing comprehensive logging of attacker behavior and system modifications.

The honeypot creates authentic-looking environments that can attract and contain malicious actors, allowing security teams to observe attack patterns, techniques, and tools used by threat actors. All interactions within the containerized environment are captured for analysis and threat intelligence purposes.

This tool represents a proof of concept implementation and has not undergone extensive testing for production environments.