Engage Goals: EGO0001 Expose, EGO0003 Elicit
Engage Approach: EAP0001 Collect, EAP0002 Detect
Engage Actions: EAC0015 Information Manipulation, EAC0018 Security Controls
Name of Element: Deceptive Windows API Calls
Description of Element:
Goal: To identify attackers attempting to make unauthorized API calls.
Approach: Monitoring API calls and analyzing attacker behavior.
This element involves creating deceptive API calls that mimic legitimate calls but return misleading or deceptive information.
Attackers who attempt to make the deceptive API calls will be identified and their actions will be logged. This information can be used to improve defenses and make it more difficult for attackers to interact with the system.
Technical Context:
This element can be combined with other deceptive elements, such as fake system files or deceptive registry keys, to enhance its effectiveness. It aligns with the MITRE ATT&CK technique T1055 (Process Injection).
Other:
This element requires a deep understanding of the Windows API and careful planning and execution to ensure that it does not interfere with the normal operation of the system.