Deception is an active-defense technique that places realistic decoys and breadcrumbs where adversaries may encounter them, making their interactions visible while misleading or delaying attacks. It is especially useful when defenders lack reliable data or adversaries avoid leaving obvious traces. section 10.1 section 10.2.2
A practical deception operation follows a repeatable pattern:
- Form a threat-hunting hypothesis, such as an intruder moving laterally after compromising an internal system. section 10.2.1
- Place realistic, nonobvious decoys and breadcrumbs across relevant network locations. section 10.1 section 10.2.1
- Monitor interactions because contact with a fake asset can produce detailed visibility into adversary tactics and techniques. section 10.1
- Maintain and update the deception environment, avoiding excessive or unusual services that could expose the trap. section 10.1 section 10.6
Internal lateral-movement hunt
In a predominantly Microsoft environment, defenders can plant fake account password hashes on Windows systems, deploy plausible Remote Desktop Services servers, or create file shares containing apparently confidential backup files. An adversary searching for additional systems or credentials may reveal activity by interacting with these assets. section 10.2.1
Deception requires coordination with system administration, security engineering, identity and access management, and monitoring teams. Misconfigured decoys can create real exposure; for example, an administrator decoy with incorrect login hours may become exploitable. section 10.2.2
