SDF-DT03

Behavioral Fingerprinting

advancedDetection Value: highCost: moderateTime: 1-2 weeks🖥 Endpoint Systems

Description

Capture detailed behavioral profiles of entities interacting with deception assets. Record command sequences, tool signatures, timing patterns, and interaction styles that create a fingerprint of the adversary operating tradecraft.

Rationale

Beyond detecting that an interaction occurred, behavioral fingerprinting tells you how the adversary operates. The sequence of commands they run, the tools they deploy, and their interaction timing patterns create a behavioral fingerprint that can be used for adversary identification, capability assessment, and detection rule development.

Supporting Basis

Literature-informed design

The sources capture or experimentally analyze attacker behavior on decoys, while the named fingerprinting workflow is broader than either source.

These sources establish design lineage and scope. They do not validate this record's operational effectiveness, planning estimates, environment labels, or ATT&CK relationships.

Implementation Steps

Deploy deep interaction logging

Install monitoring that captures every command, keystroke, file operation, and network call made by adversaries interacting with deception assets.

Configure session recording

Enable full session recording on high-interaction honeypots. Capture terminal sessions, RDP sessions, and web interactions in their entirety.

Build behavioral analysis pipeline

Create an analysis pipeline that extracts behavioral patterns: command sequences, tool deployment patterns, timing characteristics, and operational security behaviors.

Establish fingerprint database

Maintain a database of behavioral fingerprints that can be compared across incidents and correlated with known threat actor profiles.

Technical Implementation Examples(1)

Sysmon Configuration for Behavioral Fingerprinting

Sysmon configuration that captures detailed process, network, and file activity on Windows deception hosts

xml

<!-- sysmon-deception-config.xml -->
<!-- Sysmon configuration for Windows deception hosts -->
<!-- Captures comprehensive behavioral data for adversary fingerprinting -->
<!-- Install: sysmon64.exe -accepteula -i sysmon-deception-config.xml -->

<Sysmon schemaversion="4.90">
  <HashAlgorithms>sha256,imphash</HashAlgorithms>
  <CheckRevocation>false</CheckRevocation>

  <EventFiltering>
    <!-- Log ALL process creation on deception hosts -->
    <ProcessCreate onmatch="exclude">
      <!-- Exclude only essential OS processes -->
      <Image condition="is">C:\Windows\System32\svchost.exe</Image>
    </ProcessCreate>

    <!-- Log all network connections -->
    <NetworkConnect onmatch="exclude">
      <!-- Only exclude our own monitoring traffic -->
      <DestinationIp condition="is">10.200.99.10</DestinationIp>
    </NetworkConnect>

    <!-- Log all file creation -->
    <FileCreate onmatch="include">
      <TargetFilename condition="contains any">
        .exe;.dll;.ps1;.bat;.cmd;.vbs;.js;.hta;.scr
      </TargetFilename>
      <!-- Also log anything in sensitive directories -->
      <TargetFilename condition="begin with">
        C:\Users\;C:\Temp\;C:\Windows\Temp\
      </TargetFilename>
    </FileCreate>

    <!-- Log registry modifications -->
    <RegistryEvent onmatch="include">
      <TargetObject condition="contains any">
        Run;RunOnce;Services;CurrentVersion\Image
      </TargetObject>
    </RegistryEvent>

    <!-- Log DNS queries (reveals adversary recon) -->
    <DnsQuery onmatch="exclude">
      <QueryName condition="end with">.internal</QueryName>
    </DnsQuery>

    <!-- Log all clipboard access (data staging) -->
    <ClipboardChange onmatch="include">
    </ClipboardChange>

    <!-- Log process access (credential dumping detection) -->
    <ProcessAccess onmatch="include">
      <TargetImage condition="is">
        C:\Windows\System32\lsass.exe
      </TargetImage>
    </ProcessAccess>
  </EventFiltering>
</Sysmon>

MITRE ATT&CK Mappings

Technique	Tactic	Relationship
T1059Command and Scripting Interpreter	Execution	detects
T1053Scheduled Task/Job	Execution	detects

Considerations

Behavioral fingerprinting works best on high-interaction honeypots where adversaries can execute arbitrary commands. Low-interaction honeypots provide limited behavioral data.
Some adversaries practice strong operational security and may alter their behavior when they suspect monitoring. The behavioral fingerprint captures what they choose to reveal.
Behavioral data is sensitive intelligence. Store and share it through appropriate channels with access controls.

Supported Environments

🏢On-Premise

☁Amazon Web Services

☁Microsoft Azure

☁Google Cloud Platform

🔄Hybrid Environment

Tools & Resources

Session recording tools (asciinema, script)
Command logging (auditd, Sysmon)
Behavioral analysis frameworks
Threat intelligence correlation platforms

Related Techniques

SDF-DT01Interaction Tripwire Monitoring

SDF-AN01TTP Extraction and Cataloging

Quick Stats

Phase: Detect
Difficulty: advanced
Detection Value: high
Cost: moderate
Time: 1-2 weeks
ATT&CK Mappings: 2