# US 12,418,565 B2 · Deceiving attackers accessing network data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,418,565 B2 - Document ID: US12418565B2 - Status: Granted - Kind: B2 - Application number: 18/346,148 - Filed: 2023-06-30 - Published: 2024-01-04 - Granted: 2025-09-16 - Earliest claimed: 2016-12-19 - Assignees: SentinelOne, Inc. - Applicants: Sentinelone, Inc. - Inventors: Venu Vissamsetty; Anil Gupta; Harinath Vishwanath Ramchetty - Web page: https://patentgrep.com/patent/US12418565B2 ## CPC - H04L 63/1491: {using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment} - G06F 21/554: {involving event detection and direct action} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - H04L 41/12: Discovery or management of network topologies - H04L 61/4505: using standardised directories; using standardised directory access protocols - H04L 61/5007: Internet protocol [IP] addresses - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 2221/2123: Dummy operation - H04L 61/4523: using lightweight directory access protocol [LDAP] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Endpoints in a network execute a sensor module that intercepts responses from a directory service to a source on the endpoint. The sensor module determines if the source is sanctioned, such as by referencing a sanctioned list of applications. If the source is not sanctioned, then a simulated response can be provided to the source that references a decoy server. ## Claims ### Claim 1 A method performed by a computer system, the method comprising: configuring, by a computer system, a system call to refer to a function; intercepting a first response from a directory service to a source on the computer system before the first response is returned to the source, wherein the first response is a response to a request for network data received by the directory service, wherein the request for network data originates from the source on the computer system, wherein the request includes the system call; determining, by the computer system via the function, that the source on the computer system is not sanctioned by comparing the source to a list of sanctioned applications; in response to determining that the source is not sanctioned, generating, via the function, a simulated response comprising deception data and information regarding a decoy server; and returning the simulated response to the source on the computer system. ### Claim 2 (depends on 1) The method of claim 1, wherein an agent executing on the computer system intercepts the first response before it is returned to the source. ### Claim 3 (depends on 1) The method of claim 1, wherein the method is performed by an agent software executing on the computer system. ### Claim 4 (depends on 3) The method of claim 3, further comprising: substituting or modifying the function in a directory service application programming interface (API) to route the first response from the directory service to the agent software before the first response is returned to the source. ### Claim 5 (depends on 1) The method of claim 1, wherein determining that the source is not sanctioned comprises determining that the source is not in a list of sanctioned applications. ### Claim 6 (depends on 1) The method of claim 1, wherein the first response is intercepted using a substituted or modified function in a directory service application programming interface (API). ### Claim 7 (depends on 1) The method of claim 1, wherein determining that the source is not sanctioned comprises evaluating an application listening to a port to which the first response is addressed. ### Claim 8 A computer system comprising: one or more processing devices; and one or more memory devices operably coupled to the one or more processing devices, the one or more memory devices storing executable code that, when executed by the one or more processing devices, causes the one or more processing devices to: configure, by a computer system, a system call to refer to a function; intercept a first response from a directory service to a source on the computer system before the first response is returned to the source, wherein the first response is a response to a request for network data received by the directory service, wherein the request for network data originates from the source on the computer system, wherein the request includes the system call; determine, by the computer system via the function, that the source on the computer system is not sanctioned by comparing the source to a list of sanctioned applications; in response to determining that the source is not sanctioned, generate, via the function, a simulated response comprising deception data and information regarding a decoy server; and return the simulated response to the source on the computer system. ### Claim 9 (depends on 8) The system of claim 8, wherein an agent software executing on the computer system intercepts the first response before it is returned to the source. ### Claim 10 (depends on 9) The system of claim 9, wherein the executable code, when executed by the one or more processing devices, further causes the one or more processing devices to: substitute or modify the function in a directory service application programming interface (API) to route the first response from the directory service to the agent software before the first response is returned to the source. ### Claim 11 (depends on 8) The system of claim 8, wherein determining that the source is not sanctioned comprises determining that the source is not in a list of sanctioned applications. ### Claim 12 (depends on 8) The system of claim 8, wherein the first response is intercepted using a substituted or modified function in a directory service application programming interface (API). ### Claim 13 (depends on 8) The system of claim 8, wherein determining that the source is not sanctioned comprises evaluating an application listening to a port to which the first response is addressed. ### Claim 14 A non-transient computer readable medium containing program instructions for causing a computer system to perform the steps of: configuring, by a computer system, a system call to refer to a function; intercepting a first response from a directory service to a source on the computer system before the first response is returned to the source, wherein the first response is a response to a request for network data received by the directory service, wherein the request for network data originates from the source on the computer system, wherein the request includes the system call; determining, by the computer system via the function, that the source on the computer system is not sanctioned by comparing the source to a list of sanctioned applications; in response to determining that the source is not sanctioned, generating, via the function, a simulated response comprising deception data and information regarding a decoy server; and returning the simulated response to the source on the computer system. ### Claim 15 (depends on 14) The non-transient computer readable medium of claim 14, wherein an agent executing on the computer intercepts the first response before it is returned to the source. ### Claim 16 (depends on 14) The non-transient computer readable medium of claim 14, wherein the program instructions are for an agent software, and wherein the steps are performed by the agent software executing on the computer system. ### Claim 17 (depends on 16) The non-transient computer readable medium of claim 16, wherein the program instructions further cause the computer system to perform the step of: substituting or modifying the function in a directory service application programming interface (API) to route the first response from the directory service to the agent software before the first response is returned to the source. ### Claim 18 (depends on 14) The non-transient computer readable medium of claim 14, wherein determining that the source is not sanctioned comprises determining that the source is not in a list of sanctioned applications. ### Claim 19 (depends on 14) The non-transient computer readable medium of claim 14, wherein the first response is intercepted using a substituted or modified function in a directory service application programming interface (API). ### Claim 20 (depends on 14) The non-transient computer readable medium of claim 14, wherein determining that the source is not sanctioned comprises evaluating an application listening to a port to which the first response is addressed.