As an open-source, modular tool, Autre enables the automatic burn-in of deception hosts based on Windows system types. By using generative capabilities, this framework intends to reduce the complexity involved in orchestrating deception hosts on a large scale while at the same time enabling diversity and randomness in the process.
In Autre, several actions are performed to automate the setup of deception hosts by simulating the real-time activity of the users. Creating a realistic environment is the goal here, to deceive potential intruders into believing that they are being watched. Sinon's modular, adaptable nature enables a variety of changes and randomizations to be made, which gives each deployment something special.
To ensure that this research fits within the overall narrative presented by the defenders, part of the research examined the MITRE Engage framework, which describes technical capabilities around the setting up of a decoy host so that it would fit within the narrative presented by the defenders since influencing, persuading, and motivating an adversary is the key to selecting and collecting the appropriate data to close the identified intelligence gaps.
As described in MITRE Engage, it is not uncommon for organizations to develop deception decoys in a method that is almost completely manual, similar to the approach used by other organizations. To automate decoy interaction and burn-in via the application of LLMs, we can create and interact with decoy systems in a manner that generates highly realistic environments with minimal effort, thereby providing the opportunity for diverse environments to be created as required.
As a result, instead of being reliant on the same basic image repeatedly, Sinon looks at automating the parts of MITRE Engage, such as application diversity, artefact diversity, burn-in, email manipulation, information manipulation, network diversity, peripheral management, pocket litter, introduced vulnerabilities, personas, and lures. Brine concluded that Sinon would help automate the elements of MITRE Engage.
