Abstract
DejaVu is an open source deception framework which can be used to deploy decoys across the infrastructure. This could be used by the defender to deploy multiple interactive (Server and Client) decoys strategically across the network and cloud.
We have done massive updates to our platform (now DejaVu ++) and are excited to present these at Blackhat Europe. Some key updates:
- Decentralized architecture to support enterprise orgs
- Video recording of attacker’s movement, record attacker’s activity
- Highly interactive decoys to engage the attacker and reveal attacker motivation and TTP
- Integrated IDS for enriched alerts
- Full packet capture of attacker’s interaction with the decoy for forensic analysis.
- Cloud Ready decoys
- Now blue team can deploy DejaVu instance on AWS infra
- Configure decoy personality to mimic the environment
- AWS breadcrumbs
- Dashboard with monitoring and analysis - Full lifecycle of event can be drilled into by an analyst
- New decoys
- Email and client side decoys to detect Spear Phishing
- RDP Interactive and Non-Interactive
- Interactive SSH
- Detect MITM attacks : ARP Poisoning, Responder, SSDP
- HONEYCOMB (To capture events from Honey Docs)
- Beaconing Documents
- ICS/SCADA Decoys - Modbus and S7COMM
- Personalized threat inteligiance - Deploy customised decoys on DMZ to detect targeted threats
- Logging Capability - Ship logs to SIEM or other platforms using Syslog capability
https://github.com/bhdresh/Dejavu