Engage Goals: EGO0002 Affect
Engage Approach: EAP0005 Disrupt
Engage Actions: EAC0015 Information Manipulation, EAC0018 Security Controls
Name of Element: Deceptive Password Reset Mechanisms
Description of Element:
Goal: Thwart attackers’ attempts to reset passwords or gain unauthorized access through password recovery mechanisms.
Approach: Introducing deceptive password reset flows that delay attackers or lead them to decoy systems.
Implement fake password reset pages or email flows that appear to process password reset requests but instead capture attacker information, delay their progress, or redirect them to controlled environments.
Technical Context:
This element requires integration with the password management system or email infrastructure. This can be achieved through web development frameworks, email filters, or by manipulating existing password reset configurations. This aligns with the MITRE ATT&CK technique T1597 (Password Guessing).
Other:
This element can be combined with deceptive user profiles or fake authentication prompts to create a more believable illusion.