Stack Your Deception: Stacking MDE Deception Rules with Thinkst Canarytokens

What it is

A how-to for combining Microsoft Defender XDR's native Deception feature with Thinkst Canarytokens (free tier), using MDE deception rules as the delivery mechanism for tokenized lures. Concretely demonstrated with two token types: a tokenized putty.exe (Custom exe/binary token) and a tokenized PDF renamed 2024-04-21_NY_Employee_Earnings_final.pdf (Adobe PDF token).

How it works

MDE deception rules let you upload custom files as lures and deploy them to in-scope endpoints by device tag. Canarytokens are generated for free (each token just needs a destination email at generation time), downloaded, then uploaded into MDE as custom lures under a deception rule. When an attacker interacts with the tokenized file, Canarytokens fires the alert independently of MDE — so you're layering a second detection source on top of MDE's own decoys.

What to do

Enabling and configuring the feature (locations the page specifies):

• Enable: Settings > Endpoints > Advanced features, toggle Deception (near bottom of the Features list).
• Configure: Endpoints menu > Deception rules > + Add deception rule. Name it, choose lure type, set scope (all devices or by device tag, e.g. Finance/HR), confirm/edit autogenerated decoys, then add custom lures via + Add new lure > Upload file.

Deployment paths used in the example:

• exe: {HOME}\Documents\AdminTools
• PDF: {HOME}\Documents\Employee Earnings\2024\April\3

Alert routing (this is the "stacking" glue not obvious from the summary): put a Teams/Slack channel email into the Canarytoken setup so alerts land in your existing channel; or use the linked Azure Logic App ARM template to create a Sentinel incident from the received alert email, keeping the SOC in normal flow.

Two lure varieties matter for planning: Basic lures (planted documents/links, minimal environment interaction) vs Advanced lures (cached credentials, AD query interceptions that respond to the environment).

A further idea the author raises: MDE Host decoys let you customize the decoy IP — you can point these at existing OpenCanary/Thinkst honeypots in your network.

Caveats

• The author explicitly has not tested whether MDE Advanced-lure activity against a decoy host IP pointed at OpenCanary would actually trigger a canary alert — it's posed as an open question, not a validated integration.
• Beyond enabling the feature and the two token examples, the walkthrough is truncated mid-step and does not cover licensing prerequisites for MDE Deception.