Engage Goals: EGO0002 Affect
Engage Approach: EAP0004 Direct
Engage Actions: EAC0004 Network Analysis, EAC0016 Network Manipulation
Name of Element: Deceptive DNS Responses
Description of Element:
Goal: Redirect attacker traffic to a controlled environment by providing deceptive DNS responses.
Approach: Manipulating DNS resolution to redirect traffic.
This element intercepts DNS requests for known malicious domains and returns a deceptive IP address, leading attackers to a honeypot or sinkhole.
Technical Context:
This element can be implemented as a custom DNS server or by manipulating DNS records on the local system.
Other:
This element can be effective against a wide range of attacks, including malware command and control, phishing, and data exfiltration. It aligns with the MITRE ATT&CK technique T1584.001 (Domain Generation Algorithms (DGA)).