As cyber threats continue to evolve, it’s crucial for organizations to adopt proactive defense measures. The MITRE DEFEND framework, a counterpart to the MITRE ATT&CK framework, emphasizes active defense tactics, including deception, to outmaneuver adversaries.

The Deceive category in MITRE offers tactics designed to create confusion and mislead attackers about the genuine operational environment.

FortiDeceptor enables the creation of all necessary decoy objects for a successful deceive strategy, including decoy files, decoy network resources, decoy user credentials, decoy session tokens, decoy personas, and decoy public releases.

For detecting initial access attempts, deploying FortiDeceptor outbreak decoys is crucial. Administrators implement specific actions to deceive attackers, tricking them into exploiting the latest vulnerabilities.

In scenarios involving lateral movement attempts, FortiDeceptor offers a range of sophisticated tactics:

Administrators can set up SMB deception lures, generating fake network drives filled with fake files containing various sensitive data.

Use RDP deception lures to store saved usernames and passwords in the Windows Credential Manager, providing access to Windows decoys.

Utilize cached credentials lures by injecting decoy usernames and passwords into Windows memory to detect attacks, such as password dumps using tools like Mimikatz.

These actions are vital for fortifying cyber defenses and safeguarding important assets. By strategically deploying FortiDeceptor, organizations can effectively mislead attackers away from critical assets and redirect them towards their Security Operations Center (SOC).