Access Pattern Anomaly Detection

Description

Detect unusual access patterns to deception assets that indicate adversary activity even when individual interactions might appear benign. This includes detecting slow-and-low enumeration, automated scanning patterns, and systematic data collection behaviors.

Rationale

Not all adversary interactions with deception assets are obvious. Sophisticated adversaries may interact with decoys slowly and carefully, mimicking patterns that might look like legitimate access on a production system. Pattern-based detection catches these subtle interactions by analyzing sequences, timing, and volume across the deception environment holistically.

Access or attempted use of decoy information outside intended workflows is used to expose anomalous behavior.

• Bowen, B.M. et al. Baiting Inside Attackers Using Decoy Documents. SecureComm 2009, 51–70.Peer reviewed
• Spitzner, L. Honeypots: Catching the Insider Threat. ACSAC 2003, 170–179.Peer reviewed

These sources establish design lineage and scope. They do not validate this record's operational effectiveness, planning estimates, environment labels, or ATT&CK relationships.

Implementation Steps

Technical Implementation Examples(1)

{
  "_comment": "Detect systematic enumeration of deception assets",
  "_comment2": "Triggers when a single source IP contacts 3+ deception hosts within 1 hour",
  "query": {
    "bool": {
      "must": [
        { "term": { "shadow_cdf": true } },
        { "range": {
            "@timestamp": { "gte": "now-1h", "lte": "now" }
        }},
        { "terms": {
            "event.action": [
              "connection_attempted", "authentication_failed",
              "authentication_success", "service_accessed"
            ]
        }}
      ]
    }
  },
  "aggs": {
    "by_source_ip": {
      "terms": { "field": "source.ip", "min_doc_count": 3 },
      "aggs": {
        "unique_targets": {
          "cardinality": { "field": "destination.ip" }
        },
        "target_list": {
          "terms": { "field": "destination.ip", "size": 20 }
        },
        "first_seen": {
          "min": { "field": "@timestamp" }
        },
        "last_seen": {
          "max": { "field": "@timestamp" }
        },
        "filter_multi_target": {
          "bucket_selector": {
            "buckets_path": { "target_count": "unique_targets" },
            "script": "params.target_count >= 3"
          }
        }
      }
    }
  },
  "size": 0
}

MITRE ATT&CK Mappings

Considerations

• Correlation across multiple deception assets is more valuable than monitoring individual assets in isolation. An adversary who touches three honeypots in sequence is clearly enumerating.
• Time-based correlation catches slow-and-low adversaries. An interaction every few hours across different deception assets may not trigger threshold-based alerts but is clearly systematic.
• Consider the source context. An interaction from an IP address that also appears in production authentication logs warrants higher urgency than one from an unknown external IP.