Engage Goals: EGO0001 Expose, EGO0002 Affect
Engage Approach: EAP0002 Detect, EAP0005 Disrupt
Engage Actions: EAC0016 Network Manipulation, EAC0018 Security Controls
Name of Element: Decoy Web Application Firewall (WAF) with Alerting Capabilities
Description of Element:
Create a decoy WAF that mimics a legitimate one but triggers alerts or performs deceptive actions in response to specific attack patterns. This can be used to identify attackers, disrupt their activities, or gather information about their techniques.
Technical Context:
Placement: Deployed in front of a decoy web application or a non-critical service..
Utilize a software WAF (e.g., ModSecurity) or a cloud-based WAF service (e.g., AWS WAF, Azure WAF). Configure the WAF with custom rules that trigger alerts or perform deceptive actions (e.g., redirecting the attacker, injecting fake content into the response) in response to specific attack patterns. Integrate the WAF with a SIEM or other monitoring tools to centralize alert management and analysis.
Other:
Att&ck/Engage Mapping: T1190 Exploit Public-Facing Application, E1506 Decoy System