Up the Garden Path: Applying Cyber Deception to the Attack Lifecycle | SLEUTHCON 2025

Deception as behavior design

The speaker defines cyber deception as influencing financially motivated attackers' decisions and resulting actions—a dynamic "see, think, do" loop rather than static tripwires. Effective programs scale by focusing on recorded behaviors observed in the environment, not passive honeypots alone.

Recon through lateral movement

At recon, deploy discoverable sock-puppet personas mirroring real OSINT targets—verify they appear in the same search tools adversaries use. For initial access scenarios like phishing, seed plausible breach credentials. Internal SharePoint and Confluence documents can be SEO-tuned so decoy artifacts rank in search results insiders and attackers browse.

Garden path narrative example

A fictional sysadmin "James" publishes honeypot documents about "dog food optimization servers," leading attackers into high-fidelity traps. The approach prioritizes alert fidelity over noisy VM-scanner hits, taking decisive action only when adversaries engage curated deception assets across the attack lifecycle.