The worst of all deceptions is self-deception
Goal: Identify compromised systems by deploying decoy clients that mimic C2 communication patterns.
Approach: Monitoring network traffic for connections to C2 honeyclients.
Deploy decoy clients (“honeyclients”) that mimic the behavior of infected systems communicating with C2 servers. Monitor any attempts to connect to or control these honeyclients to identify compromised systems and attacker infrastructure.
Goal: Expose attackers attempting to utilize compromised accounts and gather information about their activities.
Approach: Monitoring access to and usage of honeytoken accounts.
Create realistic but fake user accounts (“honeytokens”) with attractive data or access privileges. These accounts have deceptive profiles, leading attackers towards fabricated resources or triggering alerts upon access.
Goal: To offer a comprehensive platform for deploying and managing deception campaigns.
Approach: Planning and designing deception strategies based on organizational needs.
This element provides a centralized platform for deploying and managing deception campaigns. It includes tools for creating and customizing deception assets, deploying them across the network, and monitoring their interactions with adversaries.