Engage Goals: EGO0001 Expose, EGO0003 Elicit
Engage Approach: EAP0001 Collect, EAP0002 Detect
Engage Actions: EAC0014 Software Manipulation, EAC0015 Information Manipulation
Name of Element: Deceptive API Call Responses
Description of Element:
Goal: To identify and mislead attackers attempting to manipulate system behavior through API hooking.
Approach: Monitoring API calls and providing deceptive responses. This element involves intercepting specific API calls and returning misleading or unexpected data to attackers.
By manipulating API call responses, this element can confuse attackers, disrupt their tools, or lead them down false paths.
Technical Context:
This element can be implemented using various API hooking techniques. It aligns with the MITRE ATT&CK technique T1056.001 (Input Capture: Keylogging).
Other:
This element requires careful planning and execution to avoid interfering with legitimate applications.