Description
Develop detailed behavioral profiles for priority threat actors that describe not just what tools they use, but how they think, what they prioritize, and how they react when they encounter obstacles. These profiles drive the design of deception assets that feel authentic to the specific adversaries being targeted.
Rationale
Generic honeypots catch generic adversaries. Tailored deception environments built around specific adversary profiles attract and hold the attention of the sophisticated threat actors that represent the greatest risk. Understanding how an adversary thinks, what they search for first, what makes them suspicious, and what makes them confident, directly informs deception design.
Supporting Basis
Direct antecedentMITRE Engage requires target-adversary research; ATT&CK supplies observed group behavior, and controlled decoy research shows that attacker expectations affect behavior.
- The MITRE Corporation. A Practical Guide to Adversary Engagement, version 1.0. 2022.Technical guide
- Ferguson-Walter, K.J. et al. Examining the Efficacy of Decoy-Based and Psychological Cyber Deception. USENIX Security 2021, 1127–1144.Peer reviewed
- Strom, B.E. et al. MITRE ATT&CK: Design and Philosophy. The MITRE Corporation, revised 2020.Technical report
These sources establish design lineage and scope. They do not validate this record's operational effectiveness, planning estimates, environment labels, or ATT&CK relationships.
Implementation Steps
Compile adversary intelligence
Aggregate all available intelligence on priority threat actors from commercial feeds, government advisories, industry sharing groups, and academic research.
Analyze behavioral patterns
Go beyond tool lists to understand behavioral patterns. What do they do first after gaining access? How do they handle multi-factor authentication? What triggers them to abandon an operation?
Build persona documents
Create structured persona documents for each priority adversary that capture their operational patterns, preferred techniques, known infrastructure, and likely objectives.
Validate with red team exercises
Where possible, have internal red teams emulate the profiled adversary to validate assumptions and identify gaps in the profile.
Technical Implementation Examples(1)
Adversary Profile Dossier Template
Structured JSON format for documenting adversary behavioral profiles that drive deception asset design
{
"adversary_profile": {
"designation": "THREAT-ALPHA-7",
"known_aliases": ["APT-EXAMPLE", "PHANTOM-BEAR"],
"assessed_motivation": "financial-espionage",
"assessed_capability": "advanced",
"target_industries": ["financial-services", "energy"],
"geographic_targeting": ["north-america", "western-europe"],
"behavioral_patterns": {
"initial_access": {
"preferred_methods": ["spearphishing-attachment", "valid-accounts"],
"time_to_action": "typically-within-24-hours",
"notes": "Tends to use compromised vendor credentials for initial access rather than exploit chains"
},
"post_compromise": {
"first_actions": [
"whoami", "ipconfig /all", "net group 'domain admins' /domain",
"nltest /dclist:", "systeminfo"
],
"credential_harvesting": {
"tools": ["mimikatz-variant", "custom-lsass-dumper"],
"targets": ["lsass-memory", "cached-credentials", "config-files"],
"deception_implication": "Plant fake credentials in all three target types"
},
"lateral_movement": {
"preferred_protocols": ["smb", "wmi", "rdp"],
"pattern": "hub-and-spoke from initial foothold",
"deception_implication": "Place honeypots on same subnet as likely initial compromise hosts"
}
},
"data_collection": {
"file_types_targeted": [".xlsx", ".docx", ".pdf", ".pst", ".csv"],
"search_terms_observed": ["password", "credential", "admin", "financial", "confidential"],
"deception_implication": "Seed trap documents matching these file types and naming patterns"
},
"operational_security": {
"anti_forensics": "moderate - clears event logs but not consistently",
"c2_patterns": "HTTPS beaconing with jitter, uses legitimate cloud services",
"detection_awareness": "Will abandon operation if they suspect active monitoring"
}
},
"deception_design_recommendations": {
"honeypot_services": ["smb", "rdp", "ssh"],
"credential_trap_types": ["cached-domain-creds", "config-file-passwords"],
"document_lure_types": ["financial-spreadsheets", "password-lists"],
"network_placement": "Same subnet as workstations in finance and executive departments",
"realism_requirements": "HIGH - this actor checks for VM artifacts and empty user profiles"
}
}
}MITRE ATT&CK Mappings
| Technique | Tactic | Relationship |
|---|---|---|
| T1589Gather Victim Identity Information | Reconnaissance | counters |
| T1590Gather Victim Network Information | Reconnaissance | counters |
Considerations
- Adversary profiles are perishable. Threat actors evolve their tradecraft, adopt new tools, and change targeting patterns. Profiles must be living documents.
- Avoid attribution obsession. The goal is not to identify who the adversary is, but to understand how they operate. Behavioral profiles are more useful than identity attribution for deception design.
Supported Environments
Tools & Resources
- Threat intelligence platforms with adversary tracking capabilities
- MITRE ATT&CK Groups database
- Government advisories (CISA, NSA, FBI joint advisories)
- Internal red team or adversary emulation capabilities
Quick Stats
- Phase
- Plan
- Difficulty
- advanced
- Detection Value
- medium
- Cost
- low
- Time
- 2-3 weeks
- ATT&CK Mappings
- 2