SEND - Teaching Machines to Lie to Defenders

Deception research has long used decoy files and honeypots to catch attackers. This talk argues that SOC analysts instead build causal stories from related events, and that heuristics drive their attention: escalating high-severity alerts, end-of-chain activity such as staged encryption or exfiltration, and activity near domain controllers or executive endpoints. The speakers present SEND, a self-evolving framework that aims to corrupt the story defenders reconstruct during response rather than evade detection.

SEND combines low-cost actions with implanted artifacts. Failed credential-dumping reads, dummy outbound transfers of random bytes, and mass-created ransomware-style extensions produce real telemetry without needing to succeed. An LLM-driven narrative engine keeps emails, file logs and chat entries consistent with one false explanation, and a metric called INDR scores how far the defender's reconstruction diverges from the truth. The live demo was a scripted simulation, not an attack run. In a lab with Sysmon, Zeek and Splunk, an AI blue-team agent was increasingly misled as deception tiers were added. In a small study with four volunteer analysts, two reached the wrong attribution, and end-of-chain actions accounted for most of the misdirection.

The main takeaway is that detection was never the attack surface; investigation is. For defenders, this suggests checking whether reports weigh alternative explanations, not just whether an alert fired. The speakers' next steps are multi-agent pipelines where scenario generation and detection learn from each other.