Deception Engineering

This report presents Deception Engineering as a systematic process for building, testing, and deploying deception-based defenses to disrupt adversary playbooks. Using the Group Policy Preferences (GPP) saved-password technique as a concrete example, it outlines the attack flow and tools, proposes deception opportunities (decoy OUs, fake GPOs, lures), describes the telemetry and second-order detection benefits, and discusses testing and operational considerations to achieve high-fidelity, low-false-positive detections.