Tourists looking up in large metropolitan areas and network intruders both exhibit similar behavior that can be used as a warning sign of potential attacks. Security experts recommend setting up virtual tripwires to detect unauthorized users and devices. Cisco Talos has observed a rise in high-sophistication attacks on network infrastructure, emphasizing the need to detect and detach initial footholds. Thinkst offers canary tokens that act as tripwires and alert users of suspicious activity. These tokens can be embedded in regular files and are free to use. Canaries work effectively in catching compromises early on and increasing the time taken for attackers.

https://krebsonsecurity.com/2023/08/tourists-give-themselves-away-by-looking-up-so-do-most-network-intruders/