BluSapphire
Search…
⌃K

Services (ADS - LIADS)

This article provides information on using Low-Interactive-Active-Defense-Services (LIADS) that can help you defend your network.

Overview

Active-Defense-Services (ADS) offers multiple Low-Interactive-Active-Defense-Services (LIADS) that emulate fake network protocols and services with basic functionality, in which advisories are limited in the way they interact.
These are deployed in the network with the goal, that these services are never meant to be touched/interacted with, in the first place. In doing so - emulated services detect and log connection activities and alert the security team as an intrusion is attempted.
ADS acts as an early-warning system by detecting and logging connection attempts, that may have passed you other security defenses or to catch internal threats.

Types of ADS-LIADS

Following Low-Interactive-Active-Defense-Services (LIADS) services can be emulated, and can be configured further in terms of how they look in the network. These services have their own set of configurable options like Service Port, Banner, Version, HTTP-Template, Files/Folders, and Hostname. We recommend performing ADS-related OS-level activities with a non-root user or unprivileged account.
LIADS Service
Description
SSH
Simulates Secure Shell (SSH) Service
Telnet
Simulates Telnet Service
FTP
Simulates File Transfer Protocol
RDP
Simulates Remote Desktop Protocol (RDP) Service
SMB
Simulates SMB Protocol
MySQL
Simulates MySQL Service Protocol
MS-SQL
Simulates Microsoft SQL Service Protocol
Elastic Search
Simulates Elastic Search Service Node
VNC
Simulates VNC Protocol
GIT
Simulates GIT Service Protocol
REDIS
Simulates Redis Service Protocol
TFTP
Simulates Trivial File Transfer Protocol (Non-Interactive)
SIP
Simulates Voice-Over-IP Protocol (Non-Interactive)
Basic Auth
Simulates HTTP Web Service with Basic Auth
Citrix ADC
Simulates Citrix ADC Web Service
Cisco ASA
Simulates Cisco ASA SSL VPN Web Service