Section 1: A Critical Evaluation of the Five Laws of Cyber Deception The study of deception in conflict is a discipline with a lineage stretching back to the earliest recorded military histories. From Sun Tzu’s […]
Category: ACD Elements
The Laws of Cyber Deception: Operationalizing Military Doctrine for Proactive Defense with MITRE ENGAGE
Section 1: Foundations of Deception: From Military Doctrine to Cyberspace The practice of deception is as ancient as conflict itself, a constant thread woven through the history of warfare. From the fabled Trojan Horse to […]
Fake Security Information and Event Management (SIEM) with Honey data
Deploy a decoy SIEM that collects and displays fabricated security events and alerts. This can be used to mislead attackers, waste their time, or gather information about their attempts to tamper with or evade security monitoring systems.
Decoy Web Application Firewall (WAF) with Alerting Capabilities
Create a decoy WAF that mimics a legitimate one but triggers alerts or performs deceptive actions in response to specific attack patterns. This can be used to identify attackers, disrupt their activities, or gather information about their techniques.
Fake Firewall with Permissive Ruleset
Deploy a decoy firewall with an intentionally permissive ruleset that allows most traffic to pass through. This can be used to lure attackers into a false sense of security, allowing you to observe their activities and gather intelligence on their tools and techniques.
Dynamically Changing Network Configuration
Implement a system that dynamically alters network configurations, such as IP addresses, DNS server settings, or routing tables, in response to detected attacker activity. This can be used to confuse attackers, disrupt their reconnaissance efforts, or redirect them to decoy systems.
Fake Interrupt Handler
Register a decoy interrupt handler that intercepts specific hardware or software interrupts and responds with misleading information or triggers deceptive actions. This can be used to confuse attackers, disrupt their tools, or gather information about their techniques.
Hidden Memory Region with Decoy Data
Allocate a hidden memory region within a process’s address space and populate it with fabricated data that mimics sensitive information or critical code. Monitor access attempts to this region to identify attackers attempting to extract data or inject malicious code.
Honeycomb Registry Hive
Create a decoy registry hive containing fabricated registry keys and values that mimic legitimate system configurations but contain misleading or deceptive information. Monitor access to this hive to identify attackers attempting to gather system information or modify registry settings.
Phantom Threads
Create decoy threads within legitimate processes that exhibit unusual or suspicious behavior, such as accessing sensitive registry keys or making unexpected API calls. This can be used to lure attackers into investigating these threads, wasting their time and potentially revealing their tools and techniques.