SDF-LR02

Network Path Engineering

advancedDetection Value: highCost: lowTime: 3-7 days🔗 Network Infrastructure

Description

Engineer network routing and connectivity so that adversaries naturally encounter deception assets as they move through the environment. This includes creating network segments that appear to contain valuable resources and establishing connectivity that places deception assets on natural lateral movement paths.

Rationale

Adversaries follow the path of least resistance toward high-value targets. By engineering the network so that deception assets sit on these natural paths, you increase the probability that adversaries will interact with deception infrastructure before reaching production crown jewels.

Supporting Basis

Direct antecedent

Trassare et al. implement and test presentation of a defender-chosen false route and topology to traceroute reconnaissance.

Trassare, S.T.; Beverly, R.; Alderson, D. A Technique for Network Topology Deception. MILCOM 2013, 1795–1800.Peer reviewed

These sources establish design lineage and scope. They do not validate this record's operational effectiveness, planning estimates, environment labels, or ATT&CK relationships.

Implementation Steps

Map existing lateral movement paths

Identify the network paths that an adversary would logically follow from common initial access points toward crown jewel assets.

Position deception segments

Place deception network segments adjacent to or between production segments where they will naturally appear during sequential subnet scanning.

Configure cross-segment visibility

Ensure that deception assets are visible from production segments through appropriate routing, firewall rules, and service advertisements.

Create compelling segment profiles

Make deception segments appear to contain high-value resources through DNS naming, service banners, and network service advertisements.

Technical Implementation Examples(1)

Network Path Engineering via iptables

Configure network routing to make deception subnets appear as natural lateral movement targets

on-premisebash

#!/bin/bash
# network-path-engineering.sh
# Make deception assets appear as natural lateral movement targets
# by ensuring they show up in network scans and route tables.

# Ensure deception subnet is routable from production segments
ip route add 10.200.0.0/16 via 10.0.0.1 dev eth0

# Allow ICMP (ping) so deception hosts respond to host discovery
iptables -A INPUT -s 10.0.0.0/16 -d 10.200.0.0/16 \
    -p icmp --icmp-type echo-request -j ACCEPT

# Allow TCP to common service ports on deception hosts
for PORT in 22 80 443 445 3389 1433 3306 5432 8080; do
    iptables -A FORWARD -s 10.0.0.0/16 -d 10.200.0.0/16 \
        -p tcp --dport $PORT -j ACCEPT
done

# CRITICAL: Block deception hosts from initiating connections
# back to production (isolation control)
iptables -A FORWARD -s 10.200.0.0/16 -d 10.0.0.0/16 \
    -m state --state NEW -j DROP

# Allow established/related (responses to inbound connections)
iptables -A FORWARD -s 10.200.0.0/16 -d 10.0.0.0/16 \
    -m state --state ESTABLISHED,RELATED -j ACCEPT

# Log all NEW connections to deception network for detection
iptables -A FORWARD -d 10.200.0.0/16 -m state --state NEW \
    -j LOG --log-prefix "[SHADOW-CDF-CONTACT] " --log-level info

echo "[+] Network paths configured."
echo "[*] Deception subnet 10.200.0.0/16 reachable from production"
echo "[*] Isolation: deception cannot initiate to production"
echo "[*] All new connections logged with prefix [SHADOW-CDF-CONTACT]"

MITRE ATT&CK Mappings

Technique	Tactic	Relationship
T1021Remote Services	Lateral Movement	detects
T1570Lateral Tool Transfer	Lateral Movement	detects

Considerations

Avoid creating obvious network traps where deception assets are the only hosts on a segment. Mix with or place adjacent to production segments for realism.
Test path engineering by having a red team attempt lateral movement and verify they encounter deception assets naturally.
Consider the adversary skill level. APT groups may skip sequential subnet scanning in favor of targeted movement based on directory information.

Supported Environments

🏢On-Premise

☁Amazon Web Services

☁Microsoft Azure

☁Google Cloud Platform

🔄Hybrid Environment

Tools & Resources

Network architecture design tools
Routing configuration platforms
Firewall management tools

Related Techniques

SDF-LR01DNS Record Misdirection

SDF-DP05Network Breadcrumb Deployment

Quick Stats

Phase: Lure
Difficulty: advanced
Detection Value: high
Cost: low
Time: 3-7 days
ATT&CK Mappings: 2