Place data on a system to reinforce the legitimacy of the system or user.
Pocket Litter is data placed on a system to convince an adversary that the system and users are real. Pocket Litter can be used to establish a cognitive bias to raise the adversary's tolerance to weaknesses in the environment. Unlike Decoy Artifacts, Pocket Litter does not necessarily aim to encourage the adversary to take a specific action, but rather it supports the overall deception story.
Pocket Litter can include documents, pictures, registry entries, installed software, log history, browsing history, connection history, and other user data that an adversary would expect to exist on a user's computer. For example, a defender might conduct a series of web searches to generate browser artifacts, or scatter a variety of photos and documents across the desktop to make the computer feel lived in.
|ATT&CK® Tactics||Adversary Vulnerability Presented|
|Discovery, Reconnaissance, Collection, Credential Access, Impact, Initial Access, Command and Control, Lateral Movement, Defense Evasion, Execution||When adversaries interact with the environment or personas, they are vulnerable to collecting, or in someway interact with, manipulated or decoy data. In those cases the data may increase their tolerance for imperfections in the environment and improve the overall believability of the ruse.|
|Exfiltration||When adversaries collect manipulated artifacts, they are vulnerable to reveal their presence when they use or move the artifacts elsewhere in the engagement environment.|
|Impact||When adversaries discover a diverse set of accessible resources and decoy artifacts on the target, they are vulnerable to reveal their targetting preferences and capabilities|
|Discovery||When adversaries interact with the environment or personas, they are vulnerable when they collect, observe or manipulate system artifacts or information. Manipulated data may cause them to reveal behaviors, use additional or more advanced capabilities against the target, and/or impact their dwell time.|