liveBook · Manning

Network service-based decoy

As explained in Cyber Threat Hunting

A deceptive network service that imitates a legitimate service to attract adversary activity and generate an alert when contacted or used.

A network service-based decoy imitates a legitimate HTTP, RDP, SMB, or SSH service so closely that adversaries cannot easily distinguish it from a real asset. Contact or interaction triggers an alert for threat hunters. section 10.2.3

Effective deployment depends on environmental fit and secrecy. A decoy should resemble services already present; an unusual FTP service may expose the deception to sophisticated adversaries. Knowledge of the decoy should remain limited to operational teams that need it. section 10.2.3

A practical deployment workflow connects the decoy to a credible adversary path:

  • Select a service that matches the environment. In a predominantly Windows network, RDP is more convincing than VNC or SSH for remote server management. section 10.2.4
  • Place the decoy where an intruder could plausibly reach it after initial access, such as among servers used for lateral movement. section 10.2.4
  • Enable Windows event logging for RDP so access attempts and activity on the decoy become observable. section 10.2.4
  • Route interactions to the hunting function and investigate them as probable adversary activity rather than ordinary administrative use. section 10.2.3 section 10.2.4

RDP decoy after initial compromise

An adversary obtains initial access, harvests credentials, and attempts RDP access to move through the Windows network. The realistic decoy records the interaction and sends an alert, exposing activity that might otherwise resemble legitimate remote administration. section 10.2.4

How Cyber Threat Hunting covers it

How deep it goes
Explains service selection, realism, secrecy, deployment context, and RDP logging, but does not detail decoy implementation code.
Examples
Uses HTTP, RDP, SMB, and SSH examples, emphasizing RDP in a predominantly Windows environment.
What it assumes
Assumes familiarity with network services and Windows administration while explaining RDP’s role in credential use and lateral movement.
What you can do after
Operate/configure a plausible RDP decoy, enable interaction logging, and route resulting alerts to threat hunters.
How it connects
Connects deception, threat hunting, RDP, lateral movement, credential harvesting, and Windows event logging.
Cover of Cyber Threat Hunting
liveBookmanning.com
Read Cyber Threat Hunting on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.