Abstract: The system implements in memory decoys to disrupt the attacker techniques. This has multiple benefits. 1) The attacker is never aware of a decoy present in memory as it is virtually indistinguishable from any regular process on an endpoint. 2) The decoys process also tracks attacker activity from a behavior perspective and predict and preempt the attackers next steps without alerting the attacker. 3) the decoy processes can then provide false information by intercepting the kernel responses to the attackers process and disrupt the attack chain. 4) the decoy processes can also pollute the responses that the attacker is expecting, thereby preventing the attacker from ever achieving execution of the endpoint. 5) The decoy processes also detect the attacker's evasion techniques and adjust accordingly to divert the attacker from ever achieving execution.