A file containing decoy credentials
In D3FEND’s example, a CSV file containing decoy user credentials is placed on the system; every access to the file and the credentials in it is monitored. MITRE D3FEND
A fake credential, key or record that has no real use and could only be used by an attacker.
MITRE D3FEND defines a decoy credential as a credential created to mislead an attacker: the moment it is used, a detection rule fires and subsequent steps can be tracked. MITRE D3FEND
The system-level counterpart of the same idea is the honeypot; NIST defines it as a system or resource designed to attract attackers. NIST CSRC
Because infostealers collect passwords saved in the browser, a decoy account saved in a browser can give early warning that stolen data is being used. MITRE ATT&CK
A fake account, key or document is put somewhere it looks genuine. MITRE D3FEND
An alert rule is defined for any attempt to use it. MITRE D3FEND
When used, its source and time are recorded.
In D3FEND’s example, a CSV file containing decoy user credentials is placed on the system; every access to the file and the credentials in it is monitored. MITRE D3FEND
We use cookies to ensure proper operation of our website, analyze usage, and deliver relevant content and advertisements. You can manage your preferences at any time. Cookie Policy