Description
Integrate validated indicators of compromise and behavioral signatures from deception operations into organizational threat feeds. This distributes deception-derived intelligence across the entire security stack, multiplying its protective value.
Rationale
Deception-derived IOCs and behavioral indicators can enrich defensive systems when their collection context and confidence have been reviewed. Controlled distribution to relevant tools can extend their defensive use, but indicators should be scoped, expired, and corroborated like other threat intelligence.
Supporting Basis
Author-derived extensionThe sources support shared IOC/TTP vocabularies and defensive use of collected indicators; this technique is an author-defined operational step.
- The MITRE Corporation. A Practical Guide to Adversary Engagement, version 1.0. 2022.Technical guide
- Strom, B.E. et al. MITRE ATT&CK: Design and Philosophy. The MITRE Corporation, revised 2020.Technical report
These sources establish design lineage and scope. They do not validate this record's operational effectiveness, planning estimates, environment labels, or ATT&CK relationships.
Implementation Steps
Prepare IOC packages
Package validated IOCs with appropriate metadata: confidence ratings, expiration dates, context descriptions, and recommended actions.
Distribute to internal systems
Push IOC packages to SIEM correlation rules, firewall blocklists, EDR detection policies, email security gateways, and web proxy rules.
Share with external partners
Where appropriate and authorized, share sanitized IOC packages with industry ISACs, threat sharing communities, and trusted partners.
Monitor IOC effectiveness
Track whether distributed IOCs generate matches in production security tools. Matches validate both the IOC quality and the distribution mechanism.
Technical Implementation Examples(1)
Threat Feed Distribution Script
Push validated IOCs from deception operations to SIEM, firewall, and EDR platforms
"""
Distribute deception-derived IOCs to security infrastructure.
Pushes indicators to SIEM rules, firewall blocklists, and EDR policies.
"""
import json
import requests
from typing import List, Dict
class ThreatFeedDistributor:
def __init__(self, config: Dict):
self.siem_url = config["siem_api_url"]
self.siem_key = config["siem_api_key"]
self.fw_url = config.get("firewall_api_url")
self.fw_key = config.get("firewall_api_key")
def push_to_siem(self, iocs: List[Dict]):
"""Push IOCs to SIEM as watchlist entries."""
watchlist_entries = []
for ioc in iocs:
watchlist_entries.append({
"indicator_type": ioc["type"],
"indicator_value": ioc["value"],
"description": ioc.get("description", ""),
"confidence": ioc.get("confidence", 80),
"severity": "high",
"source": "shadow-cdf-deception",
"expiration": ioc.get("valid_until", ""),
"tags": ["deception-derived", "shadow-cdf"],
})
resp = requests.post(
f"{self.siem_url}/api/v1/watchlists/shadow-cdf-iocs",
json={"entries": watchlist_entries},
headers={
"Authorization": f"Bearer {self.siem_key}",
"Content-Type": "application/json",
},
timeout=30,
)
print(f"[SIEM] Pushed {len(watchlist_entries)} IOCs: "
f"{resp.status_code}")
def push_to_firewall(self, ip_iocs: List[Dict]):
"""Push IP-based IOCs to firewall block list."""
if not self.fw_url:
print("[FW] Firewall API not configured, skipping")
return
ip_list = [
ioc["value"] for ioc in ip_iocs
if ioc["type"] == "ipv4" and ioc["confidence"] >= 80
]
resp = requests.post(
f"{self.fw_url}/api/v1/blocklists/shadow-cdf",
json={"addresses": ip_list, "action": "block"},
headers={"X-API-Key": self.fw_key},
timeout=30,
)
print(f"[FW] Pushed {len(ip_list)} IPs to blocklist: "
f"{resp.status_code}")
def distribute(self, iocs: List[Dict]):
"""Distribute IOCs to all configured platforms."""
print(f"Distributing {len(iocs)} IOCs...")
self.push_to_siem(iocs)
self.push_to_firewall(iocs)
print("Distribution complete.")
if __name__ == "__main__":
config = {
"siem_api_url": "https://siem.shadow-mgmt.internal",
"siem_api_key": "your-siem-api-key",
"firewall_api_url": "https://fw-mgmt.corp.internal",
"firewall_api_key": "your-fw-api-key",
}
with open("validated-iocs.json") as f:
iocs = json.load(f)
distributor = ThreatFeedDistributor(config)
distributor.distribute(iocs)Considerations
- IOCs have a shelf life. Network indicators may be rotated quickly by adversaries. Include expiration dates and review schedules.
- Before sharing externally, sanitize IOCs to remove any information that could reveal your deception architecture or capabilities.
- Track the operational impact of distributed IOCs. Measure how many production alerts are generated from deception-derived indicators.
Supported Environments
Tools & Resources
- Threat intelligence platforms (MISP, OpenCTI)
- STIX/TAXII servers
- SIEM integration APIs
- ISAC sharing mechanisms
Related Techniques
Quick Stats
- Phase
- Respond
- Difficulty
- intermediate
- Detection Value
- high
- Cost
- low
- Time
- 1-3 days
- ATT&CK Mappings
- 0