MITRE D3FENDdefensive technique

D3-DNR Decoy Network Resource

Official page ↗
Tactic
Deceive

Definition

Deploying a network resource for the purposes of deceiving an adversary.

How it works

How it works Decoy network resources are deployed to web application servers, network file shares, or other network based sharing services. A "honeypot" may serve a variety of decoy network resources. Considerations • Developing a deployment and placement strategy for the decoy network resource. • Personnel responsible for creation of decoy networks should consider the potential for resource exhaustion through denial of service attacks. Examples • Honeypots are typically used to mimic a known system with fake vulnerabilities. This may attract attackers to the honeypot. • Decoy accounts are also used to scan for attempted logins. The decoy accounts can provide security analysts with the attacker's potential intents and strategies. • Tarpits are used to monitor unallocated IP space for unauthorized network activity.

Related

Counters · MITRE ATT&CK (13)

  • T1074.002 Remote Data Staging sub-technique
  • T1491.002 External Defacement sub-technique
  • T1213.001 Confluence sub-technique
  • T1213.002 Sharepoint sub-technique
  • T1070.005 Network Share Connection Removal sub-technique
  • T1037.003 Network Logon Script sub-technique
  • T1491 Defacement technique
  • T1213 Data from Information Repositories technique
  • T1037 Boot or Logon Initialization Scripts technique
  • T1039 Data from Network Shared Drive technique
  • T1070 Indicator Removal technique
  • T1074 Data Staged technique
  • T1080 Taint Shared Content technique

Child of · MITRE D3FEND (1)

  • D3-DO Decoy Object defensive technique

References