Anti-Deception: Catching the Canaries

Over the past few years we've seen an expansion in both the variety of canaries and the locations to hide those canaries in the cyber deception realm. What we've yet to see is refinement in the implementation of those canaries to evade discovery from wary attackers.

For blue teams, properly tuned SIEM rules utilizing deception canaries are higher fidelity and lower volume alarms. This means that most of the time when the alarm fires it indicates a true positive. This …

attackers blue blue teams cyber cyber deception deception discovery evade expansion hide implementation realm rules siem teams