Engage Goals: EGO0001 Expose, EGO0003 Elicit
Engage Approach: EAP0001 Collect, EAP0002 Detect
Engage Actions: EAC0015 Information Manipulation, EAC0018 Security Controls
Name of Element: Fake Systemd Service
Description of Element:
Goal: To identify attackers attempting to exploit vulnerabilities in the service or to gain persistence on the system.
Approach: Monitoring the fake service for any signs of interaction or modification.This element involves creating a fake systemd service that mimics a legitimate service but performs a deceptive action, such as logging login attempts, triggering alerts, or redirecting connections to a honeypot.
Attackers who attempt to interact with or modify the fake service will be identified and their actions will be logged. This information can be used to improve defenses and make it more difficult for attackers to compromise the system.
Technical Context:
This element can be combined with other deceptive elements, such as fake files or deceptive network configurations, to enhance its effectiveness. It aligns with the MITRE ATT&CK technique T1543.003 (Create or Modify System Process: Systemd Service).
Other:
This element requires careful planning and execution to ensure that it does not interfere with the normal operation of the system.