Documentation
Comprehensive reference documentation for the ShadowMatrix CDF framework. This guide covers the framework structure, data model, and contribution process.
Framework Overview
The ShadowMatrix Cyber Deception Framework (CDF) is an operational implementation guide for cyber deception. It builds on the conceptual foundations of MITRE Engage, MITRE D3FEND, and academic deception research to provide what those frameworks leave to the practitioner: step-by-step implementation guidance, environment-specific deployment procedures, cost and time estimates, and automation-ready specifications.
While MITRE Engage defines what adversary engagement activities are available and D3FEND catalogs defensive countermeasures, ShadowMatrix CDF focuses on the operationalhow: how to plan, build, deploy, monitor, analyze, and iterate on a deception operation across different infrastructure environments.
The framework is organized around three key dimensions:
- Phases — The operational lifecycle of a deception operation, from planning through response
- Categories — The domain or asset type that the deception technique targets
- Environments — The infrastructure context where the technique applies
Each technique in the matrix lives at the intersection of a phase and category, with applicability tags for one or more environments. This three-dimensional organization allows practitioners to navigate the framework from any starting point: by operational phase, by asset domain, or by infrastructure type.
Phases Reference
The framework defines 7 operational phases that form a continuous cycle. Each phase builds on the outputs of the previous phase and feeds into the next.
| Order | Phase | Techniques | Description |
|---|---|---|---|
| 1 | ⬡ PlanStrategic Planning | 6 | Lay the groundwork for an effective deception operation by understanding your threat landscape, defining what success lo... |
| 2 | ⬢ PrepareEnvironment Preparation | 6 | Build the shadow infrastructure that will house your deception environment. This includes provisioning networks, fabrica... |
| 3 | ◆ DeployAsset Deployment | 6 | Place deception assets into strategic positions across your environment. Deploy honeypots, distribute canary tokens, pla... |
| 4 | ◈ LureAdversary Engagement | 6 | Create the trails, breadcrumbs, and attack surface features that guide adversaries toward your deception assets. Enginee... |
| 5 | ◉ DetectInteraction Detection | 6 | Monitor deception assets for adversary interaction and generate high-fidelity alerts. Because any interaction with a dec... |
| 6 | ◎ AnalyzeIntelligence Analysis | 6 | Transform raw adversary interaction data into structured intelligence. Map observed behaviors to known frameworks, extra... |
| 7 | ◍ RespondOperational Response | 6 | Close the intelligence loop by applying deception-derived insights to harden production defenses, update SOC procedures,... |
Categories Reference
Techniques are categorized by the domain or asset type they target. These 7 categories span the full range of deception surfaces.
Network Infrastructure
Deception techniques targeting network-level assets including switches, routers, firewalls, DNS services, and network segments. These techniques create convincing network environments that attract adversaries performing lateral movement and network reconnaissance.
12 techniques
Endpoint Systems
Deception focused on individual hosts, workstations, and servers. Includes fabricating realistic operating system environments, planting decoy files, and creating system artifacts that mimic active production machines.
7 techniques
Identity & Access
Techniques centered on user accounts, credentials, authentication systems, and access control mechanisms. Credential-based deception is particularly effective because credential harvesting is a universal adversary behavior.
6 techniques
Data & Documents
Deception involving files, databases, documents, and data repositories. Includes planting tracked documents, seeding databases with synthetic records, and creating data repositories that attract adversaries seeking to exfiltrate valuable information.
9 techniques
Applications & Services
Techniques targeting application-layer deception including web applications, APIs, databases, and business services. These decoys mimic the applications adversaries encounter during post-exploitation activities.
8 techniques
Cloud Resources
Deception techniques specific to cloud environments including fake storage buckets, decoy serverless functions, misleading IAM configurations, and cloud-native honeypots. Addresses the unique characteristics of AWS, Azure, and GCP environments.
0 techniques
OT/ICS Systems
Specialized deception for operational technology and industrial control system environments. Includes emulating PLCs, HMIs, SCADA interfaces, and industrial protocols. Particularly important for critical infrastructure protection.
0 techniques
Environments Reference
The framework supports 6 environment types. Each technique specifies which environments it applies to, and some techniques include environment-specific implementation guidance.
On-Premise
Traditional data center and office network environments where the organization owns and manages physical infrastructure, including servers, switches, and firewalls. Deception in on-premise environments offers maximum control over network topology and asset configuration.
41 techniques
Amazon Web Services
Deception within AWS cloud infrastructure leveraging EC2 instances, VPCs, S3 buckets, IAM policies, and other AWS-native services. Cloud deception in AWS benefits from programmatic provisioning via CloudFormation or Terraform.
42 techniques
Microsoft Azure
Deception within Azure cloud environments utilizing Virtual Machines, Virtual Networks, Azure AD, Storage Accounts, and Azure-native security services. Particularly relevant for organizations with Microsoft-centric IT estates.
42 techniques
Google Cloud Platform
Deception within GCP environments using Compute Engine instances, VPC networks, Cloud Storage, and IAM. GCP deception leverages the platform's strong networking and identity capabilities.
42 techniques
Hybrid Environment
Combined on-premise and cloud environments connected via VPN, Direct Connect, or ExpressRoute. Hybrid deception must address the seams between environments where adversaries often find opportunities.
42 techniques
OT/ICS Environment
Operational Technology and Industrial Control System environments including SCADA systems, PLCs, HMIs, and industrial networks. OT deception requires specialized protocol emulation and careful isolation to prevent impact on physical processes.
26 techniques
Data Model
Each technique in the ShadowMatrix CDF is defined by a structured data model designed for both human readability and machine consumption. The data model supports export as JSON for integration with external tools and platforms.
Technique Fields
| Field | Type | Description |
|---|---|---|
| id | string | Unique identifier (e.g., SDF-PL01) |
| name | string | Human-readable technique name |
| phase | PhaseSlug | Operational phase this technique belongs to |
| category | CategorySlug | Domain category of the technique |
| description | string | Detailed description of the technique |
| rationale | string | Why this technique matters and what value it provides |
| difficulty | DifficultyLevel | Implementation difficulty: foundational, intermediate, advanced, expert |
| environments | Environment[] | Supported infrastructure environments |
| mitreMappings | MitreMapping[] | MITRE ATT&CK techniques this counters/detects |
| implementationSteps | Step[] | Ordered steps for implementing the technique |
| detectionValue | string | Intelligence and detection value: low, medium, high, critical |
| costEstimate | string | Resource cost: minimal, low, moderate, significant |
| timeToImplement | string | Estimated implementation timeline |
| evidence | TechniqueEvidence | Provenance classification, supporting sources, and scope-of-support statement |
ID Convention
Technique IDs follow the pattern SDF-XX## where:
SDF— ShadowMatrix Deception FrameworkXX— Phase code (PL=Plan, PR=Prepare, DP=Deploy, LR=Lure, DT=Detect, AN=Analyze, RS=Respond)##— Sequential number within the phase
Contributing
The ShadowMatrix CDF is an open framework that benefits from community contributions. Here is how you can help improve and expand the framework:
Types of Contributions
- New techniques — Propose deception techniques not currently in the matrix
- Improved descriptions — Enhance existing technique descriptions with operational detail
- Environment-specific guidance — Add implementation notes for specific environments
- MITRE ATT&CK validation — Verify and improve ATT&CK technique mappings
- Operational experience — Share anonymized lessons learned from real deception deployments
- Tool recommendations — Suggest tools and resources for technique implementation
Contribution Guidelines
- All contributions must be original work or properly attributed
- Technique descriptions should be practical and operationally grounded
- Avoid including specific proprietary information or classified material
- MITRE ATT&CK mappings should reference current ATT&CK version technique IDs
- Environment-specific guidance should be validated against the target platform
How to Contribute
The project is not currently hosted on a public code platform. To propose a contribution, send your technique draft, correction, or operational feedback to [email protected]. For general questions about the framework, research collaboration, or adoption guidance, reach the project at [email protected].