D3-DF

Decoy File

Create fake documents and files that alert when opened to detect data theft and insider threats.

D3FEND / Deceive

Implementation

  • Place decoy files in sensitive locations
  • Use realistic naming and content
  • Implement callback mechanisms
  • Monitor file access events
  • Track geographic origin of callbacks

Tools

  • Canary Tokens
  • SpaceCrab
  • File Integrity Monitoring
  • Microsoft Defender
  • Custom beacon documents

ATT&CK mappings

3

MITRE D3FEND ↗