Phase 5 of 7
Detect
Interaction Detection
Monitor deception assets for adversary interaction and generate high-fidelity alerts. Because any interaction with a deception asset is inherently suspicious, detection in this context carries far less false-positive burden than traditional security monitoring.
Detection within a deception context is fundamentally different from traditional security monitoring, and this difference is the primary reason deception is such a powerful addition to the defense stack. In conventional security operations, analysts drown in alerts, most of which turn out to be false positives generated by legitimate users, automated systems, or benign anomalies. The signal-to-noise ratio is a constant struggle.
Deception-based detection flips this equation. Nobody has a legitimate reason to interact with a honeypot, authenticate with fake credentials, or open a canary-token-embedded document. Every interaction with a deception asset is, by definition, suspicious. This gives deception-generated alerts an inherently high fidelity that traditional detection mechanisms struggle to achieve.
However, high fidelity does not mean zero effort. The detection phase establishes the monitoring infrastructure, alert correlation logic, and triage workflows that transform raw interaction data into actionable intelligence. This includes configuring log collection from all deception assets, defining what constitutes a meaningful interaction versus noise (such as network scanners hitting honeypot ports), and establishing escalation procedures.
Detection also extends beyond simple alerting. Sophisticated deception operations capture rich behavioral data about how adversaries interact with decoy systems. What commands do they run? What files do they access? How do they move between systems? What tools do they deploy? This behavioral telemetry is far more valuable than a simple "someone connected to the honeypot" alert, and the detection phase needs to be designed to capture it.
The real-time nature of detection creates urgency. When a deception alert fires, it typically means an adversary is active in the environment right now. The detection phase must therefore integrate tightly with incident response procedures to enable rapid containment decisions.
Objectives
- Establish monitoring coverage across all deployed deception assets with zero blind spots
- Configure alert logic that distinguishes meaningful adversary interaction from automated noise
- Capture rich behavioral telemetry including commands, file access, and tool deployment
- Integrate deception alerts into SOC workflows with appropriate priority levels
- Enable real-time notification to incident response teams when high-confidence indicators fire
- Build correlation rules that connect multiple deception interactions into a single adversary session
Key Questions
- Q1Are we capturing the full depth of adversary interaction, or only connection-level metadata?
- Q2How quickly do deception alerts reach the analysts who need to act on them?
- Q3Can we correlate deception interactions across multiple assets to build a complete picture of adversary activity?
- Q4Are we filtering out noise from legitimate scanners and monitoring tools that may inadvertently touch deception assets?
- Q5Do our detection rules account for slow-and-low adversaries who interact with deception assets over extended periods?
Inputs
- Operational deception assets with configured logging
- Log collection and aggregation infrastructure
- SOC integration plan and alert routing procedures
- Adversary behavior baselines for interaction classification
Outputs
- Real-time alert pipeline from deception assets to SOC
- Behavioral telemetry database of adversary interactions
- Correlated incident records linking multiple deception asset interactions
- Alert triage procedures and escalation documentation
- Detection coverage reports with identified gaps
Techniques in this Phase(6)
SDF-DT01
Interaction Tripwire Monitoring
Monitor all interactions with deception assets using network and host-level instrumentation. Every connection attempt, port scan response, and service interaction is captured and evaluated as a potential adversary engagement indicator.
SDF-DT02
Canary Alert Processing
Process and prioritize alerts generated by canary token activations. Each alert represents a specific file being opened, credential being used, or URL being accessed, providing precise intelligence about adversary activity and interests.
SDF-DT03
Behavioral Fingerprinting
Capture detailed behavioral profiles of entities interacting with deception assets. Record command sequences, tool signatures, timing patterns, and interaction styles that create a fingerprint of the adversary operating tradecraft.
SDF-DT04
Access Pattern Anomaly Detection
Detect unusual access patterns to deception assets that indicate adversary activity even when individual interactions might appear benign. This includes detecting slow-and-low enumeration, automated scanning patterns, and systematic data collection behaviors.
SDF-DT05
Credential Misuse Detection
Detect attempted use of planted credentials across monitored authentication systems. Because these credentials should be excluded from legitimate workflows, an attempt is a high-suspicion event that requires investigation and confirmation of its source.
SDF-DT06
Network Flow Surveillance
Monitor network traffic flows to and from deception infrastructure to detect adversary communication patterns, data exfiltration attempts, and command-and-control channels established through deception assets.