🔑 Honey User Account

Decoy user identities in IAM/Entra ID/Cloud Identity.

→ Explore in ATT&CK matrix (27 mappings) Deployment detail

What it is

A decoy human identity that exists in the directory and can actually be authenticated against, which is what separates it from a purely inert decoy. It works as a password-spray and credential-stuffing tripwire: an attacker spraying the tenant will reach it because it looks like a real user, and no real person will ever sign in as it. The F3 rating reflects that it answers an authentication attempt rather than just sitting there.

Implementation requirements

AWS: IAM user with a console login profile, so sign-in attempts are recorded rather than rejected upstream
Azure: Entra ID user with a full profile; deliberately leave it out of conditional-access exemptions so spray attempts actually reach it
GCP: Cloud Identity user in the same organisational unit as real staff accounts
The account must hold no permissions on production resources even if its password is guessed — the credential is bait, not access
Monitoring: CloudTrail ConsoleLogin, Entra ID sign-in logs for both success and failure, GCP login audit events. A failed spray attempt is as much signal as a successful one
OPSEC: populate display name, job title and group membership to match real accounts. An empty profile is a fingerprint
Rollback: Disable, then delete the account. Remove it from groups and detection rules.
Upkeep: Keep password age and last-logon in line with real accounts, and exclude it from automated clean-up that would delete it. Monthly proof-of-life: a failed sign-in from a test host.

Cost

Low. The directory object itself is free on AWS and GCP. On Entra ID a decoy user may consume a licence seat if you want it covered by the same sign-in and conditional-access policies as real users, which is usually worth doing — an account excluded from your policies behaves differently from a real one and is easier to fingerprint.

Indicative only. Cloud pricing and licensing change — check the provider's official pricing pages for current rates before you budget.

Technologies

AWSAzureGCP

ATT&CK coverage 27

Technique	Tactic	Status	Confidence	Tier
T1114 Email Collection	Collection	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Use MailItemsAccessed to investigate compromised accounts — MailItemsAccessed records every access to mail items (sync and bind) across all mail protocols; on by default for E3/E5. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1114 Email Collection as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1114 to its Lures activity. Reading a honey mailbox is recorded by MailItemsAccessed; no study shows honey mailboxes specifically.
T1110 Brute Force	Credential Access	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2014 'Honeytoken authentication activity': any authentication activity by a honeytoken account raises an alert. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1110 to Lures: brute force against artefacts that hold no valid credentials wastes the attacker's effort.
T1110.003 Password Spraying	Credential Access	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2014: any authentication activity by a honeytoken account raises an alert. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1110.003 Password Spraying as an adversary behaviour.
T1621 Multi-Factor Authentication Request Generation	Credential Access	theoretical	moderate	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2014: any authentication activity by a honeytoken account raises an alert. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1621 Multi-Factor Authentication Request Generation as an adversary behaviour. The MFA push is generated by a sign-in attempt on the honey identity, which shares its event with T1078.
T1556 Modify Authentication Process	Defense Impairment	theoretical	moderate	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Logging management events — AWS CloudTrail User Guide — Control-plane reads and changes are management events, logged by default. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1556 Modify Authentication Process as an adversary behaviour. Changing a decoy identity-provider configuration is a logged control-plane change.
T1033 System Owner/User Discovery	Discovery	theoretical	moderate	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (3 sources) Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2014: any authentication activity by a honeytoken account raises an alert. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1033 System Owner/User Discovery as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1033 to its Lures activity. whoami/quser output is not logged per object; the honey user fires when someone later tries to use it.
T1069 Permission Groups Discovery	Discovery	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2429 'Honeytoken was queried via LDAP'; Microsoft maps it to T1069 and T1069.002. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1069 to its Lures activity.
T1069.002 Domain Groups	Discovery	confirmed	strong	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2429 'Honeytoken was queried via LDAP'; Microsoft maps it to T1069.002 Domain Groups. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1069.002 Domain Groups as an adversary behaviour.
T1087 Account Discovery	Discovery	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2429 'Honeytoken was queried via LDAP' fires on reconnaissance against a honeytoken user; Microsoft maps it to T1087 and T1087.002. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1087 to its Lures activity.
T1087.002 Domain Account	Discovery	confirmed	strong	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2429 'Honeytoken was queried via LDAP'; Microsoft maps it to T1087.002 Domain Account. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1087.002 Domain Account as an adversary behaviour.
T1087.004 Cloud Account	Discovery	theoretical	moderate	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Logging management events — AWS CloudTrail User Guide — Control-plane reads and changes (create, attach, modify, delete) are management events, logged by default. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1087.004 Cloud Account as an adversary behaviour. Listing users does not name the decoy; reading it does.
T1531 Account Access Removal	Impact	confirmed	strong	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) MITRE ATT&CK Enterprise v20.0 — Procedure examples: Akira deletes administrator accounts; LockerGoga and MegaCortex change account passwords; LAPSUS$ removed global admins. Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2427 fires on any attribute change to a honeytoken user, which a password reset or disable makes. Microsoft maps the alert to T1098; its use for T1531 is DOAR's inference. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1531 to its Lures activity.
T1078 Valid Accounts	Initial Access	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (5 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted on GitHub were used by attackers within minutes (DescribeRegions, then RunInstances). 2023 Honeypotting in the Cloud Report — AWS keys planted across nine cloud resource types were used; GitHub keys within 2 minutes. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2014: any sign-in by a honeytoken account raises an alert. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1078 to its Lures activity.
T1078.001 Default Accounts	Initial Access	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2014: any authentication activity by a honeytoken account raises an alert. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1078.001 Default Accounts as an adversary behaviour. No source covers decoy default accounts specifically.
T1566 Phishing	Initial Access	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros et al. rate T1566 as highly feasible for infrastructure deception. Message trace in the new EAC in Exchange Online — Exchange Online message trace records every message received and delivered to a given recipient. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1566 Phishing as an adversary behaviour. Backed by D003/D055; D051 is re-homed to the ATT&CK v20 AI techniques in step 5.
T1566.001 Spearphishing Attachment	Initial Access	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Message trace in the new EAC in Exchange Online — Exchange Online message trace records every message delivered to a given recipient. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1566.001 Spearphishing Attachment as an adversary behaviour.
T1566.002 Spearphishing Link	Initial Access	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Message trace in the new EAC in Exchange Online — Exchange Online message trace records every message delivered to a given recipient. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1566.002 Spearphishing Link as an adversary behaviour.
T1566.004 Spearphishing Voice	Initial Access	theoretical	weak	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1566.004 Spearphishing Voice as an adversary behaviour. No source covers decoy phone numbers.
T1534 Internal Spearphishing	Lateral Movement	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Message trace in the new EAC in Exchange Online — Exchange Online message trace records every message received and delivered to a given recipient. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1534 Internal Spearphishing as an adversary behaviour. Internal phishing that reaches a honey mailbox is recorded; no study shows it in practice.
T1078 Valid Accounts	Persistence	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (5 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted on GitHub were used by attackers within minutes (DescribeRegions, then RunInstances). 2023 Honeypotting in the Cloud Report — AWS keys planted across nine cloud resource types were used; GitHub keys within 2 minutes. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2014: any sign-in by a honeytoken account raises an alert. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1078 to its Lures activity.
T1098 Account Manipulation	Persistence	confirmed	strong	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alerts 2427 (attributes modified) and 2428 (group membership changed) fire on any change to a honeytoken user; Microsoft maps both to T1098. Logging management events — AWS CloudTrail User Guide — IAM AttachRolePolicy is a logged management event, so changes to a decoy IAM role are recorded (cloud decoys: moderate). MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1098 to its Lures activity.
T1098.005 Device Registration	Persistence	theoretical	weak	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1098.005 Device Registration as an adversary behaviour. No audit signal sourced for device registration on a decoy account.
T1556 Modify Authentication Process	Persistence	theoretical	moderate	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Logging management events — AWS CloudTrail User Guide — Control-plane reads and changes are management events, logged by default. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1556 Modify Authentication Process as an adversary behaviour. Changing a decoy identity-provider configuration is a logged control-plane change.
T1556.006 Multi-Factor Authentication	Persistence	confirmed	strong	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2427 fires on any attribute change to a honeytoken user; Microsoft's own example is changing an account's phone number to capture MFA. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1556.006 Multi-Factor Authentication as an adversary behaviour.
T1671 Cloud Application Integration	Persistence	theoretical	moderate	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Microsoft Entra security operations for applications — Microsoft Entra audit logs record 'Consent to application' and credentials added to existing applications. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1671 Cloud Application Integration as an adversary behaviour. Direct only when the attacker consents to, or adds credentials to, an existing decoy application; registering a new app touches no decoy.
T1078 Valid Accounts	Privilege Escalation	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (5 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted on GitHub were used by attackers within minutes (DescribeRegions, then RunInstances). 2023 Honeypotting in the Cloud Report — AWS keys planted across nine cloud resource types were used; GitHub keys within 2 minutes. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2014: any sign-in by a honeytoken account raises an alert. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1078 to its Lures activity.
T1098 Account Manipulation	Privilege Escalation	confirmed	strong	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alerts 2427 (attributes modified) and 2428 (group membership changed) fire on any change to a honeytoken user; Microsoft maps both to T1098. Logging management events — AWS CloudTrail User Guide — IAM AttachRolePolicy is a logged management event, so changes to a decoy IAM role are recorded (cloud decoys: moderate). MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1098 to its Lures activity.

Evidence

Decoy User Credential (D3-DUC) — MITRE D3FEND standard
Honeywords: Making Password-Cracking Detectable — Juels, A.; Rivest, R., ACM CCS 2013 peer-reviewed
Bernoulli Honeywords — Wang, K. C.; Reiter, M. K., NDSS 2024 peer-reviewed
Deceptive defense: best practices for identity-based honeytokens in Microsoft Defender for Identity — Microsoft 2023 industry
Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Microsoft industry
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard
Use MailItemsAccessed to investigate compromised accounts — Microsoft industry
Message trace in the new EAC in Exchange Online — Microsoft industry

Research basis: MITRE D3FEND D3-DUC. Juels and Rivest, "Honeywords: Making Password-Cracking Detectable" (ACM CCS 2013) and Wang, "Bernoulli Honeywords" (NDSS 2024) provide the peer-reviewed basis for detectable decoy credentials. Microsoft's 2024 identity-honeytoken guidance and the Azure-Sentinel HoneyTokens solution cover the cloud-directory form.