S
ShadowMatrix CDF
Matrix/Deploy/SDF-DP04

SDF-DP04

Decoy Service Activation

intermediateDetection Value: highCost: lowTime: 3-7 days⚙ Applications & Services

Description

Activate decoy services that present themselves as high-value targets: database servers, web applications, file shares, API endpoints, and management interfaces. These services respond realistically to interaction while logging every query and command.

Rationale

Adversaries do not interact with hosts in isolation. They interact with the services those hosts provide. Activating decoy services that present realistic interfaces to database queries, web requests, and API calls extends the deception beyond network-level detection into application-level intelligence gathering.

Supporting Basis

Direct antecedent

Honeypot and Active Deception Framework work describe activating emulated services or honey resources as deceptive targets.

These sources establish design lineage and scope. They do not validate this record's operational effectiveness, planning estimates, environment labels, or ATT&CK relationships.

Implementation Steps

1

Identify target service profiles

Determine which services should be emulated based on what exists in production and what adversaries are most likely to target.

2

Deploy service instances

Install and configure services on decoy hosts. For databases, populate with synthetic data. For web applications, deploy realistic-looking interfaces.

3

Configure service-level logging

Enable detailed logging within each service that captures queries, commands, and access patterns. This is application-level visibility beyond what network monitoring provides.

4

Test service interaction profiles

Interact with each service as an adversary would: run queries, attempt authentication, explore available endpoints. Verify realistic responses and complete logging.

Technical Implementation Examples(1)

Decoy Web Application (Flask)

A lightweight Flask application that serves as a decoy internal portal, logging every request for adversary analysis

python
"""
Decoy Internal Web Application.
Presents a realistic-looking corporate intranet portal that logs
every interaction for adversary intelligence gathering.
"""
from flask import Flask, request, jsonify, render_template_string
import json
import logging
from datetime import datetime

app = Flask(__name__)

# Configure structured JSON logging for SIEM ingestion
handler = logging.FileHandler("/var/log/decoy-webapp/access.json")
handler.setFormatter(logging.Formatter("%(message)s"))
interaction_log = logging.getLogger("interactions")
interaction_log.addHandler(handler)
interaction_log.setLevel(logging.INFO)

def log_interaction(interaction_type, details=None):
    """Log every interaction as structured JSON for SIEM."""
    event = {
        "timestamp": datetime.utcnow().isoformat() + "Z",
        "source": "shadow-cdf-decoy-webapp",
        "interaction_type": interaction_type,
        "source_ip": request.remote_addr,
        "user_agent": request.headers.get("User-Agent", ""),
        "method": request.method,
        "path": request.path,
        "headers": dict(request.headers),
        "details": details or {},
    }
    interaction_log.info(json.dumps(event))

# Realistic-looking intranet portal
PORTAL_HTML = """<!DOCTYPE html>
<html><head><title>CorpNet Intranet</title>
<style>
  body { font-family: Segoe UI, Arial, sans-serif;
         margin: 0; background: #f4f4f4; }
  .header { background: #003366; color: white; padding: 15px 30px; }
  .nav { background: #004488; padding: 0 30px; }
  .nav a { color: #ccc; text-decoration: none; padding: 12px 16px;
           display: inline-block; }
  .content { max-width: 1000px; margin: 20px auto; padding: 20px; }
  .card { background: white; border-radius: 4px; padding: 20px;
          margin: 10px 0; box-shadow: 0 1px 3px rgba(0,0,0,0.1); }
  .login-form { max-width: 400px; margin: 40px auto; }
  .login-form input { width: 100%; padding: 10px; margin: 8px 0;
                       border: 1px solid #ddd; border-radius: 4px; }
  .login-form button { width: 100%; padding: 12px; background: #003366;
                        color: white; border: none; border-radius: 4px;
                        cursor: pointer; font-size: 14px; }
</style></head>
<body>
<div class="header"><h2>CorpNet Intranet Portal</h2></div>
<div class="nav">
  <a href="/">Home</a>
  <a href="/directory">Directory</a>
  <a href="/documents">Documents</a>
  <a href="/admin">Admin</a>
  <a href="/api/v1/status">API Status</a>
</div>
<div class="content">
  <div class="login-form card">
    <h3>Sign In</h3>
    <p style="color:#666">Use your corporate credentials</p>
    <form method="POST" action="/login">
      <input type="text" name="username" placeholder="Username" />
      <input type="password" name="password" placeholder="Password" />
      <button type="submit">Sign In</button>
    </form>
  </div>
</div>
</body></html>"""

@app.before_request
def track_all_requests():
    log_interaction("page_request")

@app.route("/")
def index():
    return render_template_string(PORTAL_HTML)

@app.route("/login", methods=["POST"])
def login():
    username = request.form.get("username", "")
    password = request.form.get("password", "")
    log_interaction("login_attempt", {
        "username": username,
        "password_length": len(password),
        "password_first_char": password[0] if password else "",
    })
    return render_template_string(
        PORTAL_HTML.replace("Sign In", "Invalid credentials. Try again.")
    )

@app.route("/api/v1/status")
def api_status():
    log_interaction("api_probe")
    return jsonify({
        "status": "healthy",
        "version": "3.2.1",
        "database": "connected",
        "cache": "connected",
        "uptime_hours": 2847,
    })

@app.route("/admin")
@app.route("/admin/<path:subpath>")
def admin(subpath=""):
    log_interaction("admin_access_attempt", {"subpath": subpath})
    return "401 Unauthorized", 401

if __name__ == "__main__":
    app.run(host="0.0.0.0", port=8080)

MITRE ATT&CK Mappings

TechniqueTacticRelationship
T1190Exploit Public-Facing ApplicationInitial Accessdetects
T1071Application Layer ProtocolCommand and Controldetects

Considerations

  • Services should respond with realistic timing. A database that returns results instantaneously for every query looks artificial.
  • Include realistic error handling. Services that never return errors are suspicious.
  • For web applications, include multiple pages, realistic CSS styling, and functional navigation. A single-page site feels like a trap.

Supported Environments

🏢On-Premise
☁Amazon Web Services
☁Microsoft Azure
☁Google Cloud Platform
🔄Hybrid Environment

Tools & Resources

  • Database servers (MySQL, PostgreSQL, MSSQL) with synthetic data
  • Web application frameworks with decoy interfaces
  • File sharing services (SMB, NFS)
  • API mock servers

Related Techniques

SDF-PR03Service Emulation Engineering
SDF-DP01Honeypot Placement

Quick Stats

Phase
Deploy
Difficulty
intermediate
Detection Value
high
Cost
low
Time
3-7 days
ATT&CK Mappings
2