Goal: To identify attackers attempting to exploit vulnerabilities in the logging system or to gather information about the system’s activity.
Approach: Monitoring the deceptive daemon for any signs of interaction or modification.
This element involves configuring a deceptive syslog daemon that listens for specific log messages and triggers deceptive responses, such as sending fake alerts or redirecting attackers to a honeypot.
Attackers who attempt to interact with or modify the deceptive daemon will be identified and their actions will be logged. This information can be used to improve defenses and make it more difficult for attackers to compromise the system.