/designing-adversary-engagement-with-mitre-engage

name: designing-adversary-engagement-with-mitre-engage
description: >-
  Plan, run, and measure an adversary engagement operation using the MITRE Engage
  framework so that deployed deception is driven by strategy instead of deployed ad hoc.
  Covers the Engage Matrix (Prepare, Expose, Affect, Elicit, Understand), the 10-Step
  Operational Process, mapping engagement Activities to the ATT&CK techniques they
  expose, and defining measurable Goals and Operational Objectives. Use when a team has
  honeypots, honeytokens, or canary tokens but no coordinating strategy, when leadership
  asks "should we engage attackers and how", when building a deception/denial program,
  when writing an adversary engagement operation plan, or when deciding which deception
  Activities to deploy against a specific threat actor. Keywords: MITRE Engage, adversary
  engagement, cyber deception strategy, denial and deception, Engage Matrix, EAC, EGO,
  Expose Affect Elicit, deception program, honeypot strategy, engagement operation.
domain: cybersecurity
subdomain: deception-technology
tags:
- mitre-engage
- adversary-engagement
- deception
- denial-and-deception
- engage-matrix
- cyber-deception
- threat-intelligence
- detection-engineering
version: "1.0"
author: andrewibrah
license: Apache-2.0
nist_csf:
- GV.RM-01
- ID.RA-01
- ID.IM-02
- DE.CM-01
- DE.AE-02
mitre_attack:
- T1078
- T1083
- T1021
- T1552
- T1046

Designing Adversary Engagement with MITRE Engage

When to Use

• When an organization owns deception tooling (honeypots, honeytokens, canary tokens, decoy files) but deploys it tactically with no unifying strategy or measurable outcome.
• When leadership asks whether the organization *should* engage adversaries, and what the legal, operational, and resourcing implications are.
• When writing a formal adversary engagement operation plan that must justify every deployed deceptive artifact against a strategic goal.
• When selecting which specific deception Activities to deploy against a known or suspected threat actor based on that actor's ATT&CK TTPs.
• When building a denial, deception, and adversary engagement (DD&AE) program that must integrate with existing SOC, threat intel, and incident response functions.
• When a deception deployment generates alerts that nobody knows how to act on, because Expose was never connected to Affect or Elicit goals.

This skill is the **strategy and operations layer** that sits above tactical deployment skills (honeypot, honeytoken, canary-token, and decoy-file deployment). Use those skills to *implement* the Activities this skill selects and sequences.

Prerequisites

• Familiarity with MITRE ATT&CK (tactics, techniques, and how to read a technique page), because Engagement Activities are mapped to the ATT&CK techniques they expose.
• A documented set of critical assets and an understanding of which adversaries plausibly target them (a threat model or prioritized threat actor list).
• Executive sponsorship and a written legal review. Engagement operations interact with live adversaries and raise entrapment, evidence-handling, and liability questions; **never run an engagement operation without legal sign-off.**
• An existing detection and response capability. Engage is an additive strategy, not a replacement for defense-in-depth; if a defense-in-depth control fails, engagement keeps you in control rather than blind.
• Access to the live matrix at https://engage.mitre.org/matrix/ for canonical Activity names and IDs.

Workflow

Engage operations follow the **10-Step Operational Process**. The matrix is linear to read but cyclical to run — you continuously realign Activities toward your Goals as the adversary reacts.

1. Confirm strategic fit (Prepare)

Decide where denial, deception, and adversary engagement fit in the existing cyber strategy. The `Prepare` goal (a strategic bookend, alongside `Understand`) defines the inputs to the operation. Document the strategic goal in plain language, e.g. "reduce dwell time of insider threats around the source-code repository" or "generate first-party CTI on the actor targeting our VPN."

2. Define Engagement Goals and Operational Objectives

Select from the three Engagement Goals. Goals set direction; **Operational Objectives** take measurable steps in that direction.

| Engagement Goal (EGO) | What it does | Example Operational Objective | |---|---|---| | Expose | Reveal adversary presence with high-fidelity, low-false-positive alerts | "Alert within 5 minutes of any touch on a decoy credential" | | Affect | Negatively change the adversary's cost-value calculation (defender network only) | "Redirect the adversary away from 3 unpatchable legacy hosts" | | Elicit | Observe the adversary to learn TTPs and produce CTI | "Obtain a second-stage malware sample" or "identify ≥10 new indicators" |

Write objectives as falsifiable, time-bound statements. A goal without an objective is unmeasurable.

3. Build the threat model and select Approaches

For each Goal, pick the Engagement Approaches (EAP) that fit the adversary you modeled:

• **Expose** → Collection, Detection
• **Affect** → Prevention, Direction, Disruption
• **Elicit** → Reassurance, Motivation

4. Map ATT&CK techniques to Engagement Activities

For each technique your target adversary uses, find the Engage Activity that exposes the weakness that technique creates. Example mappings:

| Adversary technique (ATT&CK) | Weakness exposed | Engage Activity (EAC) | |---|---|---| | T1078 Valid Accounts | Must test credentials | Decoy Credentials, Lures | | T1083 File & Directory Discovery | Must enumerate files | Decoy Content, Pocket Litter | | T1046 Network Service Discovery | Must scan the network | Network Diversity, Decoy Systems | | T1021 Remote Services | Must move laterally | Decoy Systems, Network Manipulation | | T1552 Unsecured Credentials | Harvests secrets | Decoy Credentials, Artifact Diversity |

Pull the authoritative Activity list and I