⚙️ Deceptive Process Target

Hidden processes that alert on injection attempts.

→ Explore in ATT&CK matrix (12 mappings) Deployment detail

What it is

A decoy process named like a credential-bearing program, such as a password manager or backup agent, holding only fake data. Attackers open and inject into processes like these to steal secrets from memory. Nothing legitimate touches the decoy process, so any handle opened to it or code injected into it is recorded by endpoint telemetry.

Implementation requirements

Windows: run a decoy process named like a credential-bearing target (a password manager, a browser, a backup agent) under a decoy account. It does nothing and holds only fake data
Monitoring: Sysmon event 10 (ProcessAccess) and event 8 (CreateRemoteThread) with the decoy as the target image. Nothing legitimate opens or injects into it, so any hit is the signal. An EDR's process-access telemetry gives the same signal
Linux: an auditd rule on ptrace and process_vm_readv calls (a syscall rule filtered to the decoy's process), or an eBPF sensor rule (Falco, Tetragon) for access to the decoy process
Exclude your own security tools by image path and signer, so EDR scans of the decoy do not alert
Safety: the decoy holds no real secrets; any credential in its memory is a honeytoken (D006, D043). OPSEC: binary name, path, signer and parent process like the real software
Rollback: Stop and remove the decoy process and its scheduled start. Remove its detection rule exclusions.
Upkeep: Update its binary name and version with the software it imitates. Monthly proof-of-life process-access test.

Technologies

EndpointWindowsLinux

ATT&CK coverage 12

Technique	Tactic	Status	Confidence	Tier
T1007 System Service Discovery	Discovery	theoretical	weak	T2
↳ Evidence (2 sources) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1007 System Service Discovery as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1007 to its Lures activity. Listing services touches no decoy; querying a decoy service's configuration is not audited by default.
T1057 Process Discovery	Discovery	theoretical	weak	T2
↳ Evidence (3 sources) Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros et al. rate T1057 as feasible (medium) for infrastructure deception. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1057 Process Discovery as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1057 to its Lures activity. Listing processes touches no decoy.
↳ Decoy process appears in ps/tasklist — generic backing.
T1518 Software Discovery	Discovery	theoretical	weak	T2
↳ Evidence (2 sources) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1518 Software Discovery as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1518 to its Lures activity. Listing installed software touches no decoy.
T1055 Process Injection	Privilege Escalation	theoretical	moderate	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Sysmon (System Monitor) — event reference — Sysmon Event 10 (ProcessAccess) and Event 8 (CreateRemoteThread) record one process opening or injecting into another, naming the target. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1055 Process Injection as an adversary behaviour. No study shows malware selecting a decoy process; the access to it is logged if it does.
T1055.001 Dynamic-link Library Injection	Privilege Escalation	theoretical	moderate	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Sysmon (System Monitor) — event reference — Sysmon Event 10 (ProcessAccess) and Event 8 (CreateRemoteThread) record a process opening or injecting into another, naming the target. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1055.001 Dynamic-link Library Injection as an adversary behaviour. No study shows malware choosing a decoy process.
T1055.002 Portable Executable Injection	Privilege Escalation	theoretical	moderate	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Sysmon (System Monitor) — event reference — Sysmon Event 10 (ProcessAccess) and Event 8 (CreateRemoteThread) record a process opening or injecting into another, naming the target. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1055.002 Portable Executable Injection as an adversary behaviour. No study shows malware choosing a decoy process.
T1055.012 Process Hollowing	Privilege Escalation	theoretical	moderate	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Sysmon (System Monitor) — event reference — Sysmon Event 10 (ProcessAccess) and Event 8 (CreateRemoteThread) record a process opening or injecting into another, naming the target. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1055.012 Process Hollowing as an adversary behaviour. No study shows malware choosing a decoy process.
T1055 Process Injection	Stealth	theoretical	moderate	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Sysmon (System Monitor) — event reference — Sysmon Event 10 (ProcessAccess) and Event 8 (CreateRemoteThread) record one process opening or injecting into another, naming the target. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1055 Process Injection as an adversary behaviour. No study shows malware selecting a decoy process; the access to it is logged if it does.
T1055.001 Dynamic-link Library Injection	Stealth	theoretical	moderate	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Sysmon (System Monitor) — event reference — Sysmon Event 10 (ProcessAccess) and Event 8 (CreateRemoteThread) record a process opening or injecting into another, naming the target. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1055.001 Dynamic-link Library Injection as an adversary behaviour. No study shows malware choosing a decoy process.
T1055.002 Portable Executable Injection	Stealth	theoretical	moderate	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Sysmon (System Monitor) — event reference — Sysmon Event 10 (ProcessAccess) and Event 8 (CreateRemoteThread) record a process opening or injecting into another, naming the target. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1055.002 Portable Executable Injection as an adversary behaviour. No study shows malware choosing a decoy process.
T1055.012 Process Hollowing	Stealth	theoretical	moderate	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Sysmon (System Monitor) — event reference — Sysmon Event 10 (ProcessAccess) and Event 8 (CreateRemoteThread) record a process opening or injecting into another, naming the target. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1055.012 Process Hollowing as an adversary behaviour. No study shows malware choosing a decoy process.
T1574 Hijack Execution Flow	Stealth	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) 4663(S) An attempt was made to access an object — Event 4663 records reads and writes on a file or registry key that carries an audit SACL. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1574 Hijack Execution Flow as an adversary behaviour. A deliberately 'vulnerable' decoy path; the attacker's write to it is logged.

Evidence

Decoy Object (D3-DO) — MITRE D3FEND standard
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard
Sysmon (System Monitor) — event reference — Microsoft Sysinternals industry