The Fine Art of Frustrating the Adversary

• For Cybersecurity Awareness Month, eight Cisco Talos researchers share practical ways defenders can frustrate adversaries at different stages of an operation.
• Deception techniques such as honeypot accounts, false infrastructure, and tarpits can slow adversaries down while giving defenders earlier opportunities to detect their activity.
• Behavioral detections, tighter control of legitimate remote-management tools, and clear boundaries around AI agents can make essential adversary actions more visible and easier to interrupt.
• Breaking dependencies between stages of an operation can prevent an adversary from reaching their next objective.

Years ago, Cisco Talos blocked an adversary’s command-and-control (C2) traffic. The adversary responded by tweeting, “Write a rule for your a**.”

A fine endorsement of our work, if I’ve ever heard one. 

Talos loves to see an adversary forced to change course. And if every alternative for them is slower, less stealthy, less reliable and more expensive? Chef’s kiss.

Adversaries rely on certain advantages. They look for environments where tools and infrastructure allow them to blend in with normal activity. They also look for employees who can be pressured into acting before they have time to think.

Strong cybersecurity defenses can change those conditions. They take away adversary choices and increase the risk attached to essential actions, forcing them to keep making new decisions. Each change of plan costs them time and resources, and may eventually cause them to give up and move to another target.

It also creates more opportunities for defenders to spot what they are doing.

For Cybersecurity Awareness Month, we’re exploring “the fine art of frustrating the adversary.” To kick us off, I asked researchers across Talos, covering all aspects of the attack chain, for the strongest recommendation they could give defenders to seriously frustrate a potential adversary in their environment, and what that action would prevent the adversary from doing next.

Take away their choices

Many adversaries use techniques that succeed against a large number of organizations. This makes a lot of economic sense: An operation that depends on every potential target having an unusual configuration will not scale particularly well.

But it also creates an opportunity for defenders.

“By being unique and setting things up a little differently, you may be able to better defend your environment when they come knocking,” Pierre says.

For example, organizations can restrict which accounts are permitted to sign into their most critical servers, alert on connection attempts from unauthorized users, and closely monitor any changes to those restrictions. Different credentials or authentication methods can be required for particularly sensitive systems, while protected enclaves can provide increased monitoring around critical infrastructure.

Pierre also recommends that defenders “monitor (and alert) for any changes to administrative users or administrative groups.”

Of course, no amount of security measures makes an organization impenetrable, but they can make the common methods adversaries use much less dependable. 

Deception can push that uncertainty even further.

“Affecting the attack earlier rather than later in the attack chain is best,” Martin says. “Better to stop an attack from happening than minimize the consequences after it has happened.”

Martin suggests creating honeypot email accounts using expired domains with addresses that have previously leaked, or developing fictional employee profiles and seeding their addresses in places where spammers and other adversaries are likely to discover them. Because these accounts have no legitimate users, messages sent to them can be treated with far greater suspicion. The activity can provide early tactical intelligence about malicious infrastructure, lures, and campaigns, allowing defenders to put protections in place before the same operation reaches genuine employees.

Martin signed off with this note: “Have fun creating some fake employees and executives.”

Nick sees a similar role for tarpits and other forms of deception.

“False servers, shares, user accounts and network space can all be used to confuse and slow down the attacker while providing opportunities for the defender to detect them,” he says.

The same principle is beginning to appear in attempts to slow automated systems.

“We’ve even seen some new movement in the tarpit space for slowing down AI by throwing huge amounts of incoherent text at scrapers to slow them down,” Nick explains.

Deception gives the adversary another problem: they can no longer be certain that what they have found is useful, or even real. 

Plus, it can be a lot of fun.

Detect what they cannot avoid

“Attackers have enormous flexibility in how they operate, but far less flexibility in what they ultimately need to accomplish,” Ryan says. “Good detection engineering exploits that asymmetry.”

Consider an adversary attempting to obtain privileged credentials. They might use Mimikatz, comsvcs.dll, direct access to LSASS memory, a custom utility or another implementation entirely. A detection focused too narrowly on one tool can be bypassed simply by replacing it. A detection built around the underlying attempt to access credential material leaves considerably less room to maneuver.

According to Ryan, creating resilient behavioral detections requires defenders to:

• Identify the adversary techniques that would have the greatest impact in their environment
• Understand the different procedures an adversary could use to perform them;
• Find the behaviors that remain consistent when the tooling, syntax, or implementation changes
• Build analytics that account for techniques such as encoding, transformation, and obfuscation

This is more involved than matching a known tool or indicator. It requires suitable telemetry, knowledge of normal activity in the organization, and detection engineering that reflects how adversaries operate in practice.

“If done right, it forces an attacker into a dilemma: either abandon the objective, choose a noisier/less reliable path, or execute the action and risk detection,” Ryan says. “It is the highest leverage investment for defenders as well, because behavior-based detection is tool-agnostic.”

Ryan also points out that organizations do not need to begin from scratch. MITRE ATT&CK provides a useful taxonomy of adversary techniques, while projects such as MITRE Center for Threat-Informed Defense’s Summiting the Pyramid, SpecterOps’ work on capability abstraction, Splunk SURGe’s Macro ATT&CK, and Cisco Foundation AI’s LUCID explore different parts of this challenge.

Control the tools they hope to use

Sometimes the most useful tool available to an adversary is one that already has a legitimate purpose within the target environment. Remote monitoring and management (RMM) tools are a good example. Organizations use RMM software to administer systems and maintain remote access. Ransomware operators can use the same capabilities to establish persistence and interact with compromised systems before encryption.

“These are good tools that are being used for bad, making them not good in your environment but not bad for everyone,” Michael says. “So are they good or not good? Well, that depends on your specific environment.”

Warlock ransomware, for example, has used Zoho Unattended Agent. The tool can provide a remote technician with elevated permissions even when the signed-in user is not an administrator, offering the adversary persistence and a relatively benign-looking route to greater privileges.

Defenders can frustrate this activity by first inventorying the RMM products that are genuinely authorized in their environment. Application allowlisting can then permit those approved products while blocking (or producing high-confidence alerts for) unapproved tools such as AnyDesk, ScreenConnect, or Atera. Controls can be enforced through technologies such as Windows Defender Application Control, AppLocker, or endpoint detection and response (EDR) platforms.

Removing access to a familiar RMM product forces the adversary to establish persistence or C2 another way. That change does not guarantee that the operation ends, but it creates friction and another chance to detect the activity before the ransomware encryptor is deployed.

Slow them down

“Attackers use urgency to create panic and to try and trick users into making bad decisions in the heat of the moment,” says Doug.

Email, text message, and in-person scams frequently manufacture that urgency. A bill m

Key Takeaways

• Deception techniques such as honeypot accounts, false infrastructure, and tarpits can slow adversaries down while giving defenders earlier opportunities to detect their activity.
• Behavioral detections, tighter control of legitimate remote-management tools, and clear boundaries around AI agents can make essential adversary actions more visible and easier to interrupt.
• Breaking dependencies between stages of an operation can prevent an adversary from reaching their next objective, forcing them to change course and incur costs.