Engage Goals: EGO0002 Affect
Engage Approach: EAP0005 Disrupt
Engage Actions: EAC0016 Network Manipulation
Name of Element: Deceptive HTTP Response with Delayed Content
Description of Element:
Craft a web server that responds to HTTP requests with a delayed response body. This can be used to frustrate attackers, slow down automated tools, or identify attackers who are actively monitoring network traffic.
Technical Context:
Placement: Hosted on a web server accessible from the internet or within the organization’s DMZ.
Configure a web server (e.g., Apache with mod_delay, Nginx with ngx_http_limit_req_module) to introduce delays in the response. Use server-side scripting languages (e.g., PHP, Python) or Lua modules to dynamically adjust the delay based on request characteristics or attacker behavior.
Other:
Att&ck/Engage Mapping: T1102 Web Service, E1505 Decoy Network