MITRE D3FENDdefensive technique

D3-DUC Decoy User Credential

Official page ↗
Tactic
Deceive

Definition

A Credential created for the purpose of deceiving an adversary.

How it works

How it works A detection analytic is developed to determine when a user uses decoy credentials. Subsequent actions by that user may be monitored or controlled by the defender. A credential may be: • Domain username and password • Local system username and password Considerations • Decoy credentials should be integrated with a larger decoy environment to ensure that when decoy credentials are compromised, the credentials are used to interact with a decoy asset that is being monitored. • Continuous maintenance and updates are needed to ensure the legitimacy of the larger decoy environment and specifically the assets that utilize the decoy credentials.

Related

Counters · MITRE ATT&CK (25)

  • T0892 Change Credential technique
  • T1606 Forge Web Credentials technique
  • T1606.001 Web Cookies sub-technique
  • T1003.005 Cached Domain Credentials sub-technique
  • T1134.001 Token Impersonation/Theft sub-technique
  • T1134.002 Create Process with Token sub-technique
  • T1134.003 Make and Impersonate Token sub-technique
  • T1003.003 NTDS sub-technique
  • T1003.008 /etc/passwd and /etc/shadow sub-technique
  • T1110.001 Password Guessing sub-technique
  • T1110.002 Password Cracking sub-technique
  • T1110.003 Password Spraying sub-technique
  • T1558 Steal or Forge Kerberos Tickets technique
  • T1558.001 Golden Ticket sub-technique
  • T1552 Unsecured Credentials technique
  • T1550 Use Alternate Authentication Material technique
  • T1550.001 Application Access Token sub-technique
  • T1550.004 Web Session Cookie sub-technique
  • T1098.001 Additional Cloud Credentials sub-technique
  • T1539 Steal Web Session Cookie technique
  • T1528 Steal Application Access Token technique
  • T1134 Access Token Manipulation technique
  • T1003 OS Credential Dumping technique
  • T1098 Account Manipulation technique
  • T1110 Brute Force technique

Child of · MITRE D3FEND (1)

  • D3-DO Decoy Object defensive technique

References