Attacker knowledge bases
MITRE Engage
A framework for planning adversary engagement: deception, denial and decoys.
Official source Published by MITRE. Summaries in our own words.
What it is
MITRE Engage is a framework for planning and discussing adversary engagement: using denial, deception and decoys to learn about attackers, slow them down or raise their costs. It exists to make deception a structured, goal driven activity rather than ad hoc honeypots.
Who it applies to
- Security operations teams considering deception technology
- Threat intelligence teams that want to collect information about attackers in a controlled way
- Security leaders deciding whether and how to invest in deception
- Vendors of deception products, which map features to Engage
- Status
- A free framework maintained by MITRE, which succeeded the earlier MITRE Shield. It is guidance, not a standard or law.
- Enforcement
- Voluntary, with no certification. Organisations using active deception should check legal limits in their jurisdiction, for example on monitoring and data protection, and stay within their own networks.
Key points
- Start with a goal: detection, disruption or intelligence each need different designs
- Deception works best when based on how attackers behave in your environment, using ATT&CK
- Low cost measures such as honey tokens and decoy credentials give high fidelity alerts
- Engagements need clear rules, oversight and an exit plan, especially if attackers are allowed to continue
- Legal and privacy review is needed before collecting data on attackers
Where to start
- 1Read the Engage starter kit and decide on one goal
- 2Deploy a few simple decoys, such as fake credentials or files, that should never be touched
- 3Connect the alerts to your incident response process
- 4Review results and expand only where the decoys produce useful signal
How it is structured
| Goals | Expose, affect and elicit: detect attackers, influence their actions or learn about them |
|---|---|
| Strategic actions | Planning before and analysis after an engagement |
| Engagement approaches and activities | Concrete techniques such as decoy accounts, lures and isolated environments |
| Mapping to ATT&CK | Links engagement activities to attacker techniques they can counter |
A plain-language overview to help you learn, written by ThreatNoir. The official source prevails; this is not legal advice.
Items explained (1)
Ordered by how often our lessons cite them.