Forum Discussion

ansboss's avatar
ansboss
Copper Contributor
May 24, 2024

XDR Deception

Hey,   I need some assistance with deploying an XDR deception rule. Here's the situation:   I have created a deception rule with a specific tag, including 5 decoys and 2 lures. However, I'm encou...
microsoft defender for endpoint
ansboss's avatar
ansboss
Copper Contributor

DylanInfosec 

Hi,

I have used both {HOME}/ and C:\Users.

My fifth attempt to deploy is still in progress after over three days.

Any update from your side?

Thank you/\

DylanInfosec's avatar
DylanInfosec
Brass Contributor
May 29, 2024

Hey ansboss,

I had success a few days later using {HOME}\ ,ensure you use a backslash, I see you may have used a forward slash above.

 

I’m actually looking right now and can confirm I have a UI bug where my test rule says it’s still “In progress” and deployed to 0 devices. Yet I can confirm that the lures have all been set on my device. This is a “Basic” deception rule so I wonder if there’s an issue with the decoys being configured in the rule but not pushed down to the system as it’s not advanced.


You can check out the rule I created and the working paths I used for the rule on my blog, here(Attack the SOC) . Will also put a change request for the MS Docs to include an example of how to properly format the {HOME} variable as I did the same thing you did.

 

- Dylan

Resources