Engage Goals: EGO0002 Affect
Engage Approach: EAP0005 Disrupt
Engage Actions: EAC0008 Burn-In, EAC0015 Information Manipulation
Name of Element: Deceptive Local Administrator Passwords
Description of Element:
Goal: Disrupt attacker attempts to exploit common local administrator passwords for lateral movement.
Approach: Deploying a diverse set of fake local administrator passwords across systems.
Configure systems with a variety of deceptive local administrator passwords that differ from the actual password. This can slow down or frustrate attackers who rely on common passwords or credential dumping techniques.
Technical Context:
This element requires careful coordination to ensure that legitimate administrators can still access the systems. This aligns with the MITRE ATT&CK technique T1078.003 (Valid Accounts: Local Accounts).
Other:
Combine this with deceptive account lockout policies to further deter attackers.