SDF-DP05

Network Breadcrumb Deployment

intermediateDetection Value: mediumCost: minimalTime: 1-3 days🔗 Network Infrastructure

Description

Deploy network-level artifacts that lead adversaries toward deception assets. This includes ARP entries, DNS records, network shares, and routing table entries that make deception assets discoverable through standard network enumeration techniques.

Rationale

Deception assets that are invisible to network enumeration will never be found by adversaries. Network breadcrumbs ensure that standard reconnaissance tools will discover deception assets alongside real production systems, making them appear as natural parts of the environment.

Supporting Basis

Literature-informed design

The sources produce deceptive network observations and paths; treating those artifacts as deployable breadcrumbs is a ShadowMatrix synthesis.

These sources establish design lineage and scope. They do not validate this record's operational effectiveness, planning estimates, environment labels, or ATT&CK relationships.

Implementation Steps

Create DNS entries

Add DNS records for deception assets using naming conventions consistent with production. Names should suggest high-value targets: db-prod-02, fileserver-finance, admin-portal.

Configure network discovery responses

Ensure deception assets respond to ARP, ICMP, NetBIOS, and mDNS queries so they appear during network scans.

Establish network shares

Create visible network shares on deception hosts that appear in browse lists and share enumerations.

Add routing entries

Where appropriate, add routes that make deception network segments reachable from production network segments.

Technical Implementation Examples(1)

DNS Breadcrumb Deployment (Bind9 / Route53)

Add DNS records for deception assets using naming conventions that match production

bash

#!/bin/bash
# deploy-dns-breadcrumbs.sh
# Creates DNS records that make deception assets discoverable
# through standard network enumeration (nslookup, dig, nmap).

# ---- Option A: Bind9 Zone File Additions ----
# Add to the existing internal zone file: /etc/bind/zones/corp.internal

cat >> /etc/bind/zones/db.corp.internal << 'DNS_RECORDS'
; ShadowMatrix CDF Deception Assets - blend with production records
; These names suggest high-value targets to attract adversary attention

; Decoy servers (resolve to deception VPC IPs)
prod-db-04         IN A     10.200.30.10
prod-db-04-replica IN A     10.200.30.11
prod-app-srv-07    IN A     10.200.10.20
admin-portal       IN A     10.200.40.10
fileserver-finance IN A     10.200.10.30
backup-nas-02      IN A     10.200.10.40
monitoring-int     IN A     10.200.40.20
deploy-srv         IN A     10.200.20.10

; SRV records for service discovery
_mssql._tcp        IN SRV   0 0 1433 prod-db-04.corp.internal.
_http._tcp.admin   IN SRV   0 0 443  admin-portal.corp.internal.

; Reverse DNS (PTR records) for full consistency
10.30.200.10.in-addr.arpa. IN PTR prod-db-04.corp.internal.
20.10.200.10.in-addr.arpa. IN PTR prod-app-srv-07.corp.internal.
DNS_RECORDS

# Reload Bind
rndc reload

echo "[+] DNS breadcrumbs deployed for deception assets."

# ---- Option B: AWS Route53 (via CLI) ----
# aws route53 change-resource-record-sets \
#   --hosted-zone-id Z1234EXAMPLE \
#   --change-batch '{
#     "Changes": [{
#       "Action": "UPSERT",
#       "ResourceRecordSet": {
#         "Name": "prod-db-04.corp.internal",
#         "Type": "A",
#         "TTL": 300,
#         "ResourceRecords": [{"Value": "10.200.30.10"}]
#       }
#     }]
#   }'

MITRE ATT&CK Mappings

Technique	Tactic	Relationship
T1018Remote System Discovery	Discovery	counters
T1016System Network Configuration Discovery	Discovery	counters

Considerations

Naming is critical. Use names that fit your organization naming convention perfectly. An anomalous naming pattern is an easy tell.
Ensure breadcrumbs are discoverable through the tools adversaries commonly use: nmap, BloodHound, ADRecon, and cloud enumeration tools.
Do not make deception assets overly prominent. They should blend in with production assets, not stand out.

Supported Environments

🏢On-Premise

☁Amazon Web Services

☁Microsoft Azure

☁Google Cloud Platform

🔄Hybrid Environment

Tools & Resources

DNS management tools
Network configuration utilities
Active Directory for share and host registration
Cloud DNS services

Related Techniques

SDF-LR01DNS Record Misdirection

SDF-LR02Network Path Engineering

Quick Stats

Phase: Deploy
Difficulty: intermediate
Detection Value: medium
Cost: minimal
Time: 1-3 days
ATT&CK Mappings: 2