Create a decoy WAF that mimics a legitimate one but triggers alerts or performs deceptive actions in response to specific attack patterns. This can be used to identify attackers, disrupt their activities, or gather information about their techniques.
Category: Defensive
Fake Firewall with Permissive Ruleset
Deploy a decoy firewall with an intentionally permissive ruleset that allows most traffic to pass through. This can be used to lure attackers into a false sense of security, allowing you to observe their activities and gather intelligence on their tools and techniques.
Dynamically Changing Network Configuration
Implement a system that dynamically alters network configurations, such as IP addresses, DNS server settings, or routing tables, in response to detected attacker activity. This can be used to confuse attackers, disrupt their reconnaissance efforts, or redirect them to decoy systems.
Fake Interrupt Handler
Register a decoy interrupt handler that intercepts specific hardware or software interrupts and responds with misleading information or triggers deceptive actions. This can be used to confuse attackers, disrupt their tools, or gather information about their techniques.
Hidden Memory Region with Decoy Data
Allocate a hidden memory region within a process’s address space and populate it with fabricated data that mimics sensitive information or critical code. Monitor access attempts to this region to identify attackers attempting to extract data or inject malicious code.
Honeycomb Registry Hive
Create a decoy registry hive containing fabricated registry keys and values that mimic legitimate system configurations but contain misleading or deceptive information. Monitor access to this hive to identify attackers attempting to gather system information or modify registry settings.
Phantom Threads
Create decoy threads within legitimate processes that exhibit unusual or suspicious behavior, such as accessing sensitive registry keys or making unexpected API calls. This can be used to lure attackers into investigating these threads, wasting their time and potentially revealing their tools and techniques.
Fake WMI Provider with Deceptive Data
Create a decoy WMI provider that responds to attacker queries with fabricated or misleading information. This can be used to confuse attackers, disrupt their reconnaissance efforts, or gather information about their WMI-based tools and techniques.
Deceptive API Call Hooking with Modified Return Values
Intercept specific API calls made by applications and return modified or fabricated data to mislead attackers or disrupt their tools. This can be used to conceal sensitive information, trigger errors in attacker utilities, or gather intelligence on their techniques.
Fake Named Pipe with Delayed Response
Create a decoy named pipe that mimics a legitimate inter-process communication channel but introduces a significant delay before responding to client requests. This can be used to identify attackers attempting to exploit vulnerabilities or gather information through named pipes, as well as to disrupt their activities.