WraithWall
WraithWall is a threat intelligence platform that employs deception engineering to detect and analyze adversaries in real time. It deploys honeypots, canaries, credential lures, and BGP monitors to attract attackers, capturing their tools, techniques, and procedures under controlled conditions. The platform correlates sessions into campaigns, maps activity to MITRE ATT&CK, and generates operator briefs with evidence and attribution. Unlike traditional detection tools that react to alerts on production systems, WraithWall places deceptive surfaces in the path of attackers, turning their behavior into durable intelligence. It provides live telemetry, campaign correlation, and forensic write-ups, enabling security teams to understand adversary methodologies and respond proactively. The platform includes an API, SDKs for Python and JavaScript, and open-source toolkits such as canary-kit and honeypot-mitre. It is an operational deployment, not a demo, and offers a public scanner for URL detonation. WraithWall aims to reduce noise and deliver high-fidelity evidence for threat hunting and incident response.
- Category
- Security Software
- Pricing
- Unknown
Problem solved
WraithWall addresses the reactive nature of traditional security tools by proactively deceiving attackers, capturing their methods, and converting that behavior into actionable intelligence. It reduces false positives and alert fatigue by providing evidence-based attribution and campaign correlation, enabling defenders to understand and disrupt threats before they impact real assets.
Use cases
- Deploying honeypots and canaries to attract and study attackers
- Correlating attack campaigns across IPs, tools, and MITRE stages
- Generating forensic evidence with session DNA and ATT&CK mapping
- Scanning suspicious URLs for threats via a public detonation service
- Monitoring BGP hijacks and route anomalies
- Integrating threat intelligence into security operations via API and SDKs
Audience
- Developers
- Enterprise
- Startups
- Researchers
Pros
- Proactive deception-based detection reduces dwell time
- High-fidelity evidence with MITRE ATT&CK mapping
- Real-time operational telemetry and campaign correlation
- Open-source toolkits extend platform capabilities
- API and SDKs enable custom integrations
Cons
- Pricing is not publicly disclosed
- Requires significant security expertise to deploy and tune
- Limited to network and credential deception (no endpoint agents)
- May require custom integration for existing SOC workflows
- Small community and limited third-party integrations
Official website: https://wraithwall.online/
Canonical LambdaBase page: https://www.lambdabase.com/tools/wraithwall