ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Product

MITRE Engage

3 mentions in 7 days · 3 in 30 days · 3 total · first seen · last

Search everything

Timeline

CISA Urges Critical Infrastructure to Plant Decoys Inside Networks

CISA's first decoy guidance tells critical infrastructure to deploy honeytokens and tripwires inside networks, mapped via MITRE ATT&CK and Engage, to speed detection.

CISA published its first detailed cyber decoy guidance on September 16, urging critical infrastructure organizations to plant honeytokens such as fake credentials, records, and files with no legitimate business use inside their networks. The guide recommends deploying high-fidelity tripwires in high-value areas, mapping decoy coverage with MITRE ATT&CK and MITRE Engage, and continuous refinement through threat emulation. It is positioned as a complement to Zero Trust, contains no mandatory measures, and targets small and medium-sized organizations and defenders new to deception operations.

Infosecurity Magazine · 1h agoAdvisory 3 sources

CISA wants critical infrastructure orgs and smaller security teams to start using cyber decoys

CISA released guidance, "Using Cyber Decoys to Strengthen Detection and Response," helping resource-constrained teams deploy honeytokens and honeypots with existing tools.

CISA's guidance targets critical infrastructure organizations and smaller teams that struggle to detect adversaries using legitimate credentials, built-in utilities, and living-off-the-land techniques. It recommends honeytokens, honeypots, breadcrumbs, and tripwires deployed by repurposing existing EDR, IAM, and DLP tools plus open-source options rather than new purchases. Tactics are organized around MITRE Engage's Expose, Affect, and Elicit goals and include a worked water and wastewater scenario using MITRE ATT&CK mapping.

Help Net Securityupdated · 1h agofirst · 2h agoAdvisory 3 sources

Using Cyber Decoys to Strengthen Detection and Response

CISA released guidance on cyber decoys—tripwires, breadcrumbs, honeytokens—to help defenders detect adversaries using valid credentials and living-off-the-land techniques.

CISA published guidance to help defensive teams of varying maturity plan and implement cyber decoys—assets that mimic legitimate systems, accounts, or data, such as tripwires, breadcrumbs, and honeytokens—to detect adversaries using legitimate credentials and living-off-the-land techniques. The guidance frames decoys as complementing Zero Trust by producing high-fidelity alerts, reducing alert fatigue, and exposing post-compromise activity like discovery, lateral movement, and data access. It maps decoy operations to the MITRE Engage and MITRE ATT&CK frameworks with low-complexity implementation steps.

CISA Advisoriesupdated · 1h agofirst · 1d agoAdvisory 3 sources

Appears with

organization CISA 3vendor MITRE 3vendor CISA 2product MITRE ATT&CK 2organization MITRE 2organization Sysdig 1vendor Sysdig 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.