Description
Extract indicators of compromise from adversary interactions with deception assets. These IOCs, including IP addresses, domain names, file hashes, tool signatures, and behavioral patterns, feed into threat intelligence platforms and detection systems to provide ongoing protection.
Rationale
Adversaries who interact with deception assets reveal aspects of their infrastructure and tooling that can be used for detection elsewhere. IP addresses, domain names, malware hashes, and tool signatures extracted from deception interactions provide high-confidence IOCs because they are derived from observed adversary operations, not from third-party reports.
Supporting Basis
Direct antecedentThe sources describe collecting adversary tools, addresses, artifacts, and other indicators for analysis.
- Spitzner, L. Honeypots: Tracking Hackers. Addison-Wesley Professional, 2003.Practitioner book
- The MITRE Corporation. A Practical Guide to Adversary Engagement, version 1.0. 2022.Technical guide
These sources establish design lineage and scope. They do not validate this record's operational effectiveness, planning estimates, environment labels, or ATT&CK relationships.
Implementation Steps
Identify IOC sources
Review all deception telemetry for potential IOC sources: source IP addresses, DNS lookups, file downloads, tool deployments, and C2 communications.
Extract and validate IOCs
Extract IOC candidates and validate them against known benign infrastructure. Eliminate false positive risk from shared infrastructure (CDNs, cloud IPs, etc.).
Classify and rate confidence
Classify each IOC by type and assign a confidence rating based on source context, corroboration, collection integrity, and the possibility of authorized or accidental interaction.
Distribute to defensive systems
Push validated IOCs to threat intelligence platforms, SIEM correlation rules, firewall blocklists, and EDR detection rules.
Technical Implementation Examples(1)
STIX 2.1 IOC Package Generator
Generate STIX 2.1 indicator bundles from deception-derived IOCs for threat intelligence sharing
"""
STIX 2.1 IOC Package Generator.
Converts deception-derived indicators of compromise into
STIX 2.1 format for sharing via TAXII or with threat intel platforms.
"""
import json
import uuid
from datetime import datetime, timedelta
def stix_id(object_type: str) -> str:
return f"{object_type}--{uuid.uuid4()}"
def create_stix_bundle(iocs: list) -> dict:
"""Create a STIX 2.1 bundle from deception-derived IOCs."""
now = datetime.utcnow().strftime("%Y-%m-%dT%H:%M:%S.000Z")
valid_until = (
datetime.utcnow() + timedelta(days=30)
).strftime("%Y-%m-%dT%H:%M:%S.000Z")
identity_id = stix_id("identity")
objects = [
{
"type": "identity",
"spec_version": "2.1",
"id": identity_id,
"created": now,
"modified": now,
"name": "ShadowMatrix CDF Deception Intelligence",
"identity_class": "organization",
}
]
for ioc in iocs:
indicator_id = stix_id("indicator")
if ioc["type"] == "ipv4":
pattern = f"[ipv4-addr:value = '{ioc['value']}']"
elif ioc["type"] == "domain":
pattern = f"[domain-name:value = '{ioc['value']}']"
elif ioc["type"] == "sha256":
pattern = f"[file:hashes.'SHA-256' = '{ioc['value']}']"
elif ioc["type"] == "url":
pattern = f"[url:value = '{ioc['value']}']"
else:
continue
indicator = {
"type": "indicator",
"spec_version": "2.1",
"id": indicator_id,
"created": now,
"modified": now,
"created_by_ref": identity_id,
"name": ioc.get("name", f"IOC: {ioc['value']}"),
"description": ioc.get("description",
"Indicator derived from ShadowMatrix CDF deception operations"),
"indicator_types": ["malicious-activity"],
"pattern": pattern,
"pattern_type": "stix",
"valid_from": now,
"valid_until": valid_until,
"confidence": ioc.get("confidence", 85),
"labels": ["shadow-cdf", "deception-derived"],
}
objects.append(indicator)
bundle = {
"type": "bundle",
"id": stix_id("bundle"),
"objects": objects,
}
return bundle
if __name__ == "__main__":
# Example IOCs extracted from deception environment
iocs = [
{
"type": "ipv4",
"value": "198.51.100.42",
"name": "C2 Server observed in deception environment",
"description": "IP address connected to honeypot and "
"attempted lateral movement to 3 decoy hosts",
"confidence": 90,
},
{
"type": "sha256",
"value": "a1b2c3d4e5f6...abcdef1234567890",
"name": "Malware sample dropped on honeypot",
"description": "Binary uploaded to Cowrie honeypot via "
"wget from adversary staging server",
"confidence": 95,
},
{
"type": "domain",
"value": "updates.evil-example.com",
"name": "C2 domain resolved from deception host",
"description": "DNS query from compromised decoy host "
"to suspected C2 infrastructure",
"confidence": 80,
},
]
bundle = create_stix_bundle(iocs)
output = json.dumps(bundle, indent=2)
print(output)
with open("shadow-cdf-iocs.stix.json", "w") as f:
f.write(output)
print(f"\nGenerated STIX bundle with {len(bundle['objects'])} objects")Considerations
- Be cautious with IP-based IOCs from cloud providers, VPNs, and Tor exit nodes. These may have high false positive rates due to IP reuse.
- Tool hashes and behavioral signatures are more durable IOCs than network indicators, which adversaries frequently rotate.
- Consider sharing validated IOCs with industry peers through ISACs and threat sharing communities. This multiplies the value of your deception intelligence.
Supported Environments
Tools & Resources
- Threat intelligence platforms (MISP, OpenCTI)
- SIEM platforms
- IOC extraction scripts
- Malware analysis sandboxes
Related Techniques
Quick Stats
- Phase
- Analyze
- Difficulty
- intermediate
- Detection Value
- high
- Cost
- low
- Time
- 1-3 days per engagement
- ATT&CK Mappings
- 0