synoti logosynoti logo
Antivirus Deceptive Bytes

Detection rules for Deceptive Bytes Data sources. Every rule contains its MITRE ATT&CK mapping, an impact rating, and details on what it identifies.

This category lists 16 detection rules.

RuleCategoryTechniqueImpact (C/I/A)
Advanced Threat Tactic IdentificationAdvanced Persistent ThreatMultiple TacticsC:3 / I:3 / A:3
Criminal Group SignaturesOrganized Crime ActivityCriminal Group TTPsC:3 / I:3 / A:2
Data Theft Attempt on Decoy FilesCollectionT1005 - Data from Local SystemC:3 / I:2 / A:1
Deception API Call TrackingExecutionT1106 - Native APIC:2 / I:2 / A:1
Deception Token Access PatternsDefense Evasion, Persistence, Privilege Escalation, Initial AccessT1078 - Valid Accounts: Credential AccessC:3 / I:3 / A:1
Decoy Share Access MonitoringDiscoveryT1135 - Network Share DiscoveryC:3 / I:2 / A:1
Decoy System EnumerationDiscoveryT1082 - System Information DiscoveryC:3 / I:2 / A:1
Fake User Authentication AttemptsCredential AccessT1110 - Brute ForceC:3 / I:3 / A:1
Honey Table Query DetectionCollectionT1005 - Data from Local SystemC:3 / I:2 / A:1
Lateral Movement Trap TriggeredLateral MovementT1021 - Remote ServicesC:3 / I:3 / A:2
Living Off The Land Attack Using Deceptive ResourcesDefense EvasionT1218 - Signed Binary Proxy ExecutionC:3 / I:3 / A:2
Nation-State Tactic DetectionAdvanced Persistent ThreatT1595 - Active Scanning / Nation-State Attack PatternsC:3 / I:3 / A:3
Privilege Escalation Bait AccessedPrivilege EscalationT1068 - Exploitation for Privilege EscalationC:3 / I:3 / A:2
Ransomware Behavior Detected in Deception EnvironmentImpactT1486 - Data Encrypted for ImpactC:3 / I:3 / A:3
Threat Actor AttributionThreat IntelligenceT1583 - Acquire InfrastructureC:2 / I:2 / A:2
Zero-Day Behavior Patterns DetectionDefense EvasionT1211 - Exploitation for Defense EvasionC:3 / I:3 / A:3

Rule Example

Below is an example of a rule definition for Advanced Threat Tactic Identification (view in repository):

# Rule version v1.0.0

dataTypes:
  - deceptive-bytes
name: Advanced Threat Tactic Identification
impact:
  confidentiality: 3
  integrity: 3
  availability: 3
category: Advanced Persistent Threat
technique: Multiple Tactics
adversary: origin
references:
  - https://attack.mitre.org/tactics/TA0001/
  - https://attack.mitre.org/tactics/TA0002/
  - https://attack.mitre.org/tactics/TA0003/
description: |
  Detects advanced threat tactics including initial access, execution, and persistence techniques by monitoring deception environment interactions and behavioral patterns. This rule triggers when deceptive assets are accessed with high behavior scores indicating sophisticated attack patterns.
  
  Next Steps:
  1. Immediately isolate the affected endpoint(s) associated with the source IP
  2. Review the specific tactic name to understand the attack phase (initial access, execution, persistence, etc.)
  3. Check all deception assets that were triggered to map the attacker's movement
  4. Analyze the behavior score details to understand the sophistication level
  5. Look for related alerts from the same source IP across different systems
  6. Collect forensic data from the endpoint before any remediation
  7. Review authentication logs for any credential abuse from this source
  8. Check network logs for lateral movement attempts
  9. Update security controls to block the identified tactics
  10. Consider deploying additional deception assets in the path of the attacker
where: |
  equals("log.eventType", "advanced_threat_detected") &&
  equals("log.threatLevel", "critical") &&
  (oneOf("log.tacticName", ["initial_access", "execution", "persistence", "privilege_escalation", "defense_evasion"])) &&
  equals("log.deceptionTriggered", true) &&
  greaterOrEqual("log.behaviorScore", 80)
afterEvents:
  - indexPattern: v1-7-22-log-deceptive-bytes-*
    with:
      - field: origin.ip
        operator: filter_term
        value: '{{.origin.ip}}'
      - field: log.tacticName
        operator: filter_term
        value: '{{.log.tacticName}}'
    within: now-15m
    count: 3
groupBy:
  - lastEvent.log.tacticName
  - lastEvent.log.threatLevel
  - adversary.ip

Rule Details

Advanced Threat Tactic Identification

Recognizes advanced threat tactics such as initial access, execution, and persistence by watching deception environment interactions and behavioral patterns. This rule fires when deceptive assets are touched with high behavior scores that point to sophisticated attack activity.

Criminal Group Signatures

Spots attack signatures and behavioral patterns tied to known criminal groups, such as ransomware crews, financial crime rings, and organized cybercrime operations. Deception technology uncovers malicious activity by watching interactions with decoy assets that legitimate workflows should never touch.

Data Theft Attempt on Decoy Files

Detects efforts to access, copy, or exfiltrate deceptive decoy files and honeypot data, signaling possible data theft by an attacker. This rule fires when an attacker interacts with high-sensitivity decoy files placed by Deceptive Bytes.

Deception API Call Tracking

Monitors suspicious API calls to decoy services or endpoints. This activity suggests an attacker is trying to interact with what they think are real services but are in fact deception assets.

Deception Token Access Patterns

Detects access to deception tokens or honeytokens, which can indicate possible unauthorized activity or an insider threat. Repeated token access from one source in a short period points to methodical reconnaissance or data harvesting. Honeytokens are fake credentials or access tokens placed as traps to catch unauthorized access.

Decoy Share Access Monitoring

Detects attempts by an attacker to reach decoy network shares created by Deceptive Bytes. This points to possible lateral movement or reconnaissance inside the network. Any interaction with decoy shares is a high-confidence sign of malicious activity, because legitimate users should never access these resources.

Decoy System Enumeration

Detects when an attacker carries out system enumeration against decoy systems or services. This covers port scanning, service discovery, or gathering system information from deception assets.

Fake User Authentication Attempts

Detects sign-in attempts that use decoy user accounts created by Deceptive Bytes. This suggests an attacker has acquired credentials they believe are valid and is trying to use them.

Honey Table Query Detection

Detects an attacker querying honey tables or decoy database objects deployed by Deceptive Bytes. This can point to possible data exfiltration or database reconnaissance. Honey tables are intentionally planted decoy data designed to attract and expose unauthorized access attempts.

Lateral Movement Trap Triggered

Detects when an attacker sets off a deceptive trap while trying to move laterally across the network. This points to possible compromise and active threat movement inside the environment.

Living Off The Land Attack Using Deceptive Resources

Detects attackers using legitimate system tools and binaries to interact with deceptive resources, which signals Living Off The Land (LOLBins) techniques. This is a high-confidence sign of malicious activity, since legitimate users should not use system binaries to access deceptive resources.

Nation-State Tactic Detection

Detects sophisticated attack patterns and techniques often linked to nation-state actors, including advanced persistence methods, custom tooling, and strategic lateral movement.

Privilege Escalation Bait Accessed

Detects when an attacker reaches deceptive privileged account baits or tries to escalate privileges with trapped credentials, which signals active exploitation. This is a high-priority alert because it shows an active attacker who has moved past initial access and is trying to gain elevated privileges.

Ransomware Behavior Detected in Deception Environment

Detects behavior patterns resembling ransomware when attackers interact with deceptive files, including fast file enumeration, encryption attempts, and ransom note creation within the Deceptive Bytes deception environment.

Threat Actor Attribution

Correlates observed attack patterns, tools, techniques, and infrastructure against known threat actor profiles to deliver attribution intelligence and identify possible threat actors using high-confidence indicators.

Zero-Day Behavior Patterns Detection

Identifies possible zero-day exploits and unknown malware by analyzing abnormal behavior patterns, deception interactions, and anomalies in endpoint activities.