Phase 4 of 7
Lure
Adversary Engagement
Create the trails, breadcrumbs, and attack surface features that guide adversaries toward your deception assets. Engineer the discovery process so that finding and interacting with decoys feels natural and rewarding to the attacker.
Deployment puts assets in place. Luring makes sure adversaries find them. This distinction is critical because even perfectly crafted deception assets are worthless if attackers never interact with them. The lure phase engineers the discovery experience so that stumbling onto your deception environment feels like a natural part of the attacker's workflow.
Effective luring requires a deep understanding of adversary tradecraft at each stage of an intrusion. During reconnaissance, attackers scan for services, enumerate DNS records, and look for exposed endpoints. During initial access, they search for credentials, exploit vulnerabilities, and probe authentication systems. During lateral movement, they look for connected systems, shared drives, and privileged accounts. Each of these stages presents an opportunity to dangle something enticing.
The key principle is that breadcrumbs should be discoverable through the techniques attackers are already using, not through some artificial mechanism that would raise suspicion. If an attacker is running BloodHound to map Active Directory, they should find a path that leads to a deception domain controller. If they are scraping configuration files for database passwords, they should find credentials that authenticate against a decoy database. The lure should fit seamlessly into the attacker's existing methodology.
There is a fine balance between making deception assets too easy and too hard to find. An asset that appears on the first network scan with default credentials screams "trap." An asset buried so deep that only an insider would know about it will never see adversary interaction. The sweet spot is slightly off the beaten path, requiring enough effort to find that the attacker feels they earned it, but not so much that they move on to other targets.
This phase also addresses the ongoing nature of luring. Breadcrumbs go stale, DNS records get pruned, and network topologies change. Maintaining effective lures requires periodic review and adjustment, particularly after infrastructure changes that might orphan or expose deception breadcrumbs.
Objectives
- Create discovery mechanisms that align with how adversaries actually perform reconnaissance and enumeration
- Engineer breadcrumb trails that guide attackers from initial access toward high-value deception assets
- Craft attack surface features that present compelling but controlled vulnerability surfaces
- Ensure that lure mechanisms are subtle enough to avoid detection by sophisticated adversaries
- Establish feedback loops to measure lure effectiveness and adjust placement over time
Key Questions
- Q1Are our breadcrumbs discoverable through the same tools and techniques our target adversaries use?
- Q2Is the path from breadcrumb to deception asset believable, or does it feel artificially convenient?
- Q3Have we calibrated the difficulty correctly - not too easy to be suspicious, not too hard to be ignored?
- Q4How will we know if an adversary found our breadcrumb but chose not to follow it?
- Q5Are our lures resilient to infrastructure changes that might break the trail?
Inputs
- Deployed deception assets with known network locations and access requirements
- Adversary tradecraft profiles detailing reconnaissance and enumeration techniques
- Network topology and service maps for breadcrumb placement
- Production environment patterns that breadcrumbs should mimic
Outputs
- Deployed breadcrumb trails across network, endpoint, and identity surfaces
- DNS and service discovery entries pointing to deception infrastructure
- Credential artifacts placed in locations matching adversary harvesting patterns
- Controlled vulnerability surfaces on deception assets
- Lure effectiveness measurement baseline
Techniques in this Phase(6)
SDF-LR01
DNS Record Misdirection
Create DNS entries that point to deception assets using names that suggest high-value internal resources. Adversaries who perform DNS enumeration will discover these records and follow them to deception infrastructure, believing they have found legitimate targets.
SDF-LR02
Network Path Engineering
Engineer network routing and connectivity so that adversaries naturally encounter deception assets as they move through the environment. This includes creating network segments that appear to contain valuable resources and establishing connectivity that places deception assets on natural lateral movement paths.
SDF-LR03
Credential Breadcrumb Trails
Create discoverable trails of credential-related artifacts that lead adversaries from their current position toward deception infrastructure. This includes cached credentials, stored sessions, and authentication artifacts placed in locations that adversaries routinely search.
SDF-LR04
Vulnerability Surface Crafting
Present controlled vulnerability surfaces on deception assets that entice adversaries to attempt exploitation. These surfaces appear to be exploitable weaknesses but are actually instrumented observation points that capture adversary tools, exploits, and techniques.
SDF-LR05
Lateral Movement Channels
Create apparent lateral movement opportunities that guide adversaries from compromised production systems toward deception infrastructure. This includes trust relationships, network shares, and remote access paths that exist solely to redirect adversary lateral movement.
SDF-LR06
Supply Chain Decoys
Create fake supply chain artifacts including decoy code repositories, package registries, API endpoints, and vendor portals that attract adversaries conducting supply chain reconnaissance or attempting supply chain compromise.