Engage Goals: EGO0001 Expose, EGO0003 Elicit
Engage Approach: EAP0001 Collect, EAP0002 Detect
Engage Actions: EAC0015 Information Manipulation, EAC0018 Security Controls
Name of Element: Privileged User Account Decoy
Description of Element:
This element is a decoy user account that appears to have elevated privileges within the system. The account is monitored for any login attempts or activity, which would indicate an attacker trying to gain unauthorized access.
Technical Context:
Placement: Within the organization’s Active Directory or other identity management system.
This element reinforces the principle of continuous authentication and authorization, as even privileged accounts should be subject to scrutiny.
Other:
Att&ck/Engage Mapping: Valid Accounts (T1078) / Decoy Account (E1503) / Decoy System (E1506)