Engage Goals: EGO0001 Expose
Engage Approach: EAP0002 Detect
Engage Actions: EAC0012 Personas, EAC0018 Security Controls
Name of Element: Azure Active Directory (AD) Decoy User Accounts
Description of Element:
Create fake user accounts within Azure AD with enticing names or roles (e.g., “admin,” “backup_admin”). Monitor login attempts and activity related to these accounts to identify credential stuffing or brute-force attacks.
Technical Context:
Placement: Integrate these accounts within the organization’s Azure AD structure.
Requires understanding of Azure AD user management and security best practices.
Other:
Att&ck/Engage Mapping: T1078 Valid Accounts, E1503 Decoy Account