Esc
Decoy Object
Definition
A Decoy Object is created and deployed for the purposes of deceiving attackers.
Synonyms: Lure.Technique Overview
Decoy objects are typically configured with detectable means of communication but do not have any legitimate business purpose. Any communication via or to these objects should be logged and analyzed to find potential indicators of compromise for a possible past or future attack against other systems.
Artifact Relationships:
This defensive technique is related to specific artifacts. Click the artifact node for more information.
Technique Subclasses
There are 7 techniques in this category, Decoy Object.
| Name | ID | Definition | Synonyms |
|---|---|---|---|
| Decoy Object | D3-DO | A Decoy Object is created and deployed for the purposes of deceiving attackers. | Lure |
| - Decoy Public Release | D3-DPR | Issuing publicly released media to deceive adversaries. | |
| - Decoy File | D3-DF | A file created for the purposes of deceiving an adversary. | |
| - Decoy Session Token | D3-DST | An authentication token created for the purposes of deceiving an adversary. | |
| - Decoy Persona | D3-DP | Establishing a fake online identity to misdirect, deceive, and or interact with adversaries. | |
| - Decoy User Credential | D3-DUC | A Credential created for the purpose of deceiving an adversary. | |
| - Decoy Network Resource | D3-DNR | Deploying a network resource for the purposes of deceiving an adversary. |
Related ATT&CK Techniques:
These mappings are inferred, experimental, and will improve as the
knowledge graph grows.
These offensive techniques are determined related because of the way this defensive technique,, , , and .
Lateral Movement
Taint Shared Content
Software Deployment Tools
Use Alternate Authentication Material
Internal Spearphishing
Privilege Escalation
Abuse Elevation Control Mechanism
Access Token Manipulation
Process Injection
Account Manipulation
Boot or Logon Autostart Execution
Event Triggered Execution
Hijack Execution Flow
Create or Modify System Process
Scheduled Task/Job
Boot or Logon Initialization Scripts
Command And Control
Encrypted Channel
Application Layer Protocol
Impact
Defacement
Data Encrypted for Impact
Data Manipulation
Collection
Data from Network Shared Drive
Data Staged
Automated Collection
Data from Information Repositories
Archive Collected Data
Data from Local System
Email Collection
Discovery
System Network Configuration Discovery
Remote System Discovery
System Owner/User Discovery
File and Directory Discovery
Persistence
Account Manipulation
Office Application Startup
Boot or Logon Autostart Execution
Event Triggered Execution
Hijack Execution Flow
Modify Authentication Process
Create or Modify System Process
Scheduled Task/Job
Server Software Component
Boot or Logon Initialization Scripts
Execution
Software Deployment Tools
User Execution
Command and Scripting Interpreter
Scheduled Task/Job
Credential Access
Brute Force
OS Credential Dumping
Steal or Forge Kerberos Tickets
Unsecured Credentials
Modify Authentication Process
Steal Application Access Token
Forced Authentication
Credentials from Password Stores
Steal Web Session Cookie
Keychain
Forge Web Credentials
Steal or Forge Authentication Certificates
Defense Evasion
Abuse Elevation Control Mechanism
Indicator Removal
Masquerading
Access Token Manipulation
Process Injection
System Binary Proxy Execution
Obfuscated Files or Information
Use Alternate Authentication Material
Hide Artifacts
Trusted Developer Utilities Proxy Execution
Hijack Execution Flow
Deobfuscate/Decode Files or Information
Modify Authentication Process
Rootkit
Impair Defenses
XSL Script Processing
Exfiltration
Exfiltration Over C2 Channel
Exfiltration Over Alternative Protocol