UTMSTACK logoUTMSTACK logo
Antivirus Deceptive Bytes

Detection rules for Deceptive Bytes data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects.

This category contains 16 detection rules.

RuleCategoryTechniqueImpact (C/I/A)
Advanced Threat Tactic IdentificationAdvanced Persistent ThreatMultiple TacticsC:3 / I:3 / A:3
Criminal Group SignaturesOrganized Crime ActivityCriminal Group TTPsC:3 / I:3 / A:2
Data Theft Attempt on Decoy FilesCollectionT1005 - Data from Local SystemC:3 / I:2 / A:1
Deception API Call TrackingExecutionT1106 - Native APIC:2 / I:2 / A:1
Deception Token Access PatternsDefense Evasion, Persistence, Privilege Escalation, Initial AccessT1078 - Valid Accounts: Credential AccessC:3 / I:3 / A:1
Decoy Share Access MonitoringDiscoveryT1135 - Network Share DiscoveryC:3 / I:2 / A:1
Decoy System EnumerationDiscoveryT1082 - System Information DiscoveryC:3 / I:2 / A:1
Fake User Authentication AttemptsCredential AccessT1110 - Brute ForceC:3 / I:3 / A:1
Honey Table Query DetectionCollectionT1005 - Data from Local SystemC:3 / I:2 / A:1
Lateral Movement Trap TriggeredLateral MovementT1021 - Remote ServicesC:3 / I:3 / A:2
Living Off The Land Attack Using Deceptive ResourcesDefense EvasionT1218 - Signed Binary Proxy ExecutionC:3 / I:3 / A:2
Nation-State Tactic DetectionAdvanced Persistent ThreatT1595 - Active Scanning / Nation-State Attack PatternsC:3 / I:3 / A:3
Privilege Escalation Bait AccessedPrivilege EscalationT1068 - Exploitation for Privilege EscalationC:3 / I:3 / A:2
Ransomware Behavior Detected in Deception EnvironmentImpactT1486 - Data Encrypted for ImpactC:3 / I:3 / A:3
Threat Actor AttributionThreat IntelligenceT1583 - Acquire InfrastructureC:2 / I:2 / A:2
Zero-Day Behavior Patterns DetectionDefense EvasionT1211 - Exploitation for Defense EvasionC:3 / I:3 / A:3

Rule Example

Below is an example of a rule definition for Advanced Threat Tactic Identification (view in repository):

# Rule version v1.0.0

dataTypes:
  - deceptive-bytes
name: Advanced Threat Tactic Identification
impact:
  confidentiality: 3
  integrity: 3
  availability: 3
category: Advanced Persistent Threat
technique: Multiple Tactics
adversary: origin
references:
  - https://attack.mitre.org/tactics/TA0001/
  - https://attack.mitre.org/tactics/TA0002/
  - https://attack.mitre.org/tactics/TA0003/
description: |
  Detects advanced threat tactics including initial access, execution, and persistence techniques by monitoring deception environment interactions and behavioral patterns. This rule triggers when deceptive assets are accessed with high behavior scores indicating sophisticated attack patterns.
  
  Next Steps:
  1. Immediately isolate the affected endpoint(s) associated with the source IP
  2. Review the specific tactic name to understand the attack phase (initial access, execution, persistence, etc.)
  3. Check all deception assets that were triggered to map the attacker's movement
  4. Analyze the behavior score details to understand the sophistication level
  5. Look for related alerts from the same source IP across different systems
  6. Collect forensic data from the endpoint before any remediation
  7. Review authentication logs for any credential abuse from this source
  8. Check network logs for lateral movement attempts
  9. Update security controls to block the identified tactics
  10. Consider deploying additional deception assets in the path of the attacker
where: |
  equals("log.eventType", "advanced_threat_detected") &&
  equals("log.threatLevel", "critical") &&
  (oneOf("log.tacticName", ["initial_access", "execution", "persistence", "privilege_escalation", "defense_evasion"])) &&
  equals("log.deceptionTriggered", true) &&
  greaterOrEqual("log.behaviorScore", 80)
afterEvents:
  - indexPattern: v11-log-deceptive-bytes-*
    with:
      - field: origin.ip
        operator: filter_term
        value: '{{.origin.ip}}'
      - field: log.tacticName
        operator: filter_term
        value: '{{.log.tacticName}}'
    within: now-15m
    count: 3
groupBy:
  - lastEvent.log.tacticName
  - lastEvent.log.threatLevel
  - adversary.ip

Rule Details

Advanced Threat Tactic Identification

Detects advanced threat tactics including initial access, execution, and persistence techniques by monitoring deception environment interactions and behavioral patterns. This rule triggers when deceptive assets are accessed with high behavior scores indicating sophisticated attack patterns.

Criminal Group Signatures

Identifies attack signatures and behavioral patterns associated with known criminal groups including ransomware operators, financial crime syndicates, and organized cybercrime operations. Deception technology detects malicious activity by monitoring interactions with decoy assets that should never be accessed in legitimate workflows.

Data Theft Attempt on Decoy Files

Detects attempts to access, copy, or exfiltrate deceptive decoy files and honeypot data, indicating potential data theft activities by an attacker. This rule triggers when an attacker interacts with high-sensitivity decoy files planted by Deceptive Bytes.

Deception API Call Tracking

Tracks suspicious API calls made to decoy services or endpoints. This behavior indicates an attacker is attempting to interact with what they believe are legitimate services but are actually deception assets.

Deception Token Access Patterns

Detects when deception tokens or honeytokens are accessed, indicating potential unauthorized activity or insider threat. Multiple token accesses from the same source within a short timeframe suggest systematic reconnaissance or data harvesting attempts. Honeytokens are fake credentials or access tokens planted as traps to detect unauthorized access.

Decoy Share Access Monitoring

Detects when an attacker attempts to access decoy network shares set up by Deceptive Bytes. This indicates potential lateral movement or reconnaissance activity within the network. Any interaction with decoy shares is a high-confidence indicator of malicious activity since legitimate users should never access these resources.

Decoy System Enumeration

Detects when an attacker performs system enumeration activities on decoy systems or services. This includes port scanning, service discovery, or system information gathering on deception assets.

Fake User Authentication Attempts

Detects authentication attempts using decoy user accounts created by Deceptive Bytes. This indicates an attacker has obtained what they believe are valid credentials and is attempting to use them.

Honey Table Query Detection

Detects when an attacker queries honey tables or decoy database objects deployed by Deceptive Bytes. This indicates potential data exfiltration attempts or database reconnaissance. Honey tables are deliberately placed decoy data designed to attract and identify unauthorized access attempts.

Lateral Movement Trap Triggered

Detects when an attacker triggers a deceptive trap while attempting lateral movement across the network. This indicates potential compromise and active threat movement within the environment.

Living Off The Land Attack Using Deceptive Resources

Detects when attackers use legitimate system tools and binaries to interact with deceptive resources, indicating Living Off The Land (LOLBins) attack techniques. This is a high-confidence indicator of malicious activity as legitimate users should not be accessing deceptive resources with system binaries.

Nation-State Tactic Detection

Detects sophisticated attack patterns and techniques commonly associated with nation-state actors including advanced persistence mechanisms, custom tooling, and strategic lateral movement.

Privilege Escalation Bait Accessed

Detects when an attacker accesses deceptive privileged account baits or attempts to escalate privileges using trapped credentials, indicating active exploitation attempts. This is a high-priority alert as it indicates an active attacker who has progressed beyond initial access and is attempting to gain elevated privileges.

Ransomware Behavior Detected in Deception Environment

Detects ransomware-like behavior patterns when attackers interact with deceptive files, including rapid file enumeration, encryption attempts, and ransom note creation in the Deceptive Bytes deception environment.

Threat Actor Attribution

Correlates observed attack patterns, tools, techniques, and infrastructure with known threat actor profiles to provide attribution intelligence and identify potential threat actors based on high-confidence indicators.

Zero-Day Behavior Patterns Detection

Identifies potential zero-day exploits and unknown malware through abnormal behavior patterns, deception interactions, and anomaly detection in endpoint activities.