EAC0015 – Page 2 – D E C E I V E R . I O

Deceive, Detect, Engage

Deceptive OAuth 2.0 Consent Screen

Craft a fake OAuth 2.0 consent screen that mimics a legitimate Google service but requests excessive or unusual permissions. Monitor interactions with this screen to identify attackers attempting to trick users into granting unauthorized access.

Fake Google Workspace Shared Drive with “Confidential” Documents

Create a decoy Google Workspace Shared Drive containing fabricated documents with names suggesting sensitive information (e.g., “Financial Projections,” “Customer Database”). Monitor access and download activity to identify attackers attempting to exfiltrate data.

Azure Storage Account with Honeyfiles

Create a decoy Azure Storage Account containing fabricated files that appear to be valuable or sensitive. Monitor access patterns and download attempts to identify attackers seeking to exfiltrate data or gain unauthorized access.

Azure Logic App Honeypot

Deploy a non-functional Azure Logic App that mimics a critical workflow. Monitor any attempts to trigger or interact with this app to detect reconnaissance or attempts to disrupt business processes.

Azure Key Vault Honeytoken

Create a fake Azure Key Vault instance containing decoy secrets and keys. Monitor access to this vault to detect attempts to steal sensitive information.

Fake Search Queries

This element involves manipulating the user’s search engine query history to include fake or misleading search terms.

Fake Print Jobs

This element involves creating fake print jobs that appear to contain sensitive or confidential information but are actually filled with fabricated data or trigger alerts upon printing.

Fake Clipboard Content

This element involves manipulating the user’s clipboard to contain fake or misleading information.

Fabricated Application Logs

This element involves creating fake entries in the user’s application logs, indicating actions or events that did not actually occur.