Services (ADS - LIADS)

This article provides information on using Low-Interactive-Active-Defense-Services (LIADS) that can help you defend your network.

Overview

Active-Defense-Services (ADS) offers multiple Low-Interactive-Active-Defense-Services (LIADS) that emulate fake network protocols and services with basic functionality, in which advisories are limited in the way they interact.

These are deployed in the network with the goal, that these services are never meant to be touched/interacted with, in the first place. In doing so - emulated services detect and log connection activities and alert the security team as an intrusion is attempted.

ADS acts as an early-warning system by detecting and logging connection attempts, that may have passed you other security defenses or to catch internal threats.

Types of ADS-LIADS

Following Low-Interactive-Active-Defense-Services (LIADS) services can be emulated, and can be configured further in terms of how they look in the network. These services have their own set of configurable options like Service Port, Banner, Version, HTTP-Template, Files/Folders, and Hostname. We recommend performing ADS-related OS-level activities with a non-root user or unprivileged account.

LIADS Service	Description
SSH	Simulates Secure Shell (SSH) Service
Telnet	Simulates Telnet Service
FTP	Simulates File Transfer Protocol
RDP	Simulates Remote Desktop Protocol (RDP) Service
SMB	Simulates SMB Protocol
MySQL	Simulates MySQL Service Protocol
MS-SQL	Simulates Microsoft SQL Service Protocol
Elastic Search	Simulates Elastic Search Service Node
VNC	Simulates VNC Protocol
GIT	Simulates GIT Service Protocol
REDIS	Simulates Redis Service Protocol
TFTP	Simulates Trivial File Transfer Protocol (Non-Interactive)
SIP	Simulates Voice-Over-IP Protocol (Non-Interactive)
Basic Auth	Simulates HTTP Web Service with Basic Auth
Citrix ADC	Simulates Citrix ADC Web Service
Cisco ASA	Simulates Cisco ASA SSL VPN Web Service