Engage Goals: EGO0002 Affect
Engage Approach: EAP0005 Disrupt
Engage Actions: EAC0003 System Activity Monitoring, EAC0015 Information Manipulation
Name of Element: WMI Event Deception
Description of Element:
Goal: Disrupt attacker activity by generating deceptive WMI events.
Approach: Generating fake WMI events to confuse attackers.
This element generates deceptive WMI events that mimic legitimate system activity but contain false information. This can confuse attackers and disrupt their reconnaissance or lateral movement efforts.
Technical Context:
This element leverages the Windows Management Instrumentation (WMI) framework for system management. It creates and delivers events that appear legitimate but contain deceptive data.
Other:
This element can be particularly effective against attackers who rely on WMI for information gathering or command execution.