🔑 Honey Federation Provider

Fake SAML/OIDC IdP configurations to detect golden SAML.

→ Explore in ATT&CK matrix (8 mappings) Deployment detail

What it is

A decoy identity-provider trust — a SAML or OIDC configuration that appears to federate a third-party IdP into your cloud tenant. It targets golden-SAML and trust-modification attacks specifically: an attacker who wants to forge assertions has to first find and read the federation config, and an attacker establishing persistence often adds or edits one. Because federation config is touched rarely and by very few admins, any read or write against a decoy trust stands out.

Implementation requirements

AWS: SAML identity-provider object in IAM holding decoy IdP metadata, with no role trust policy pointing at it
Azure: federated domain configuration in Entra ID resolving to an IdP endpoint that does not exist
GCP: Workforce Identity Federation pool and provider with no service-account impersonation bindings
The signing certificate in the decoy metadata must be well-formed and valid, but correspond to a key you control and never use
Monitoring: CloudTrail AssumeRoleWithSAML attempts and any CreateSAMLProvider / UpdateSAMLProvider call, Entra ID federation-config change events, GCP audit logs on the workforce pool
OPSEC: a federation trust to an IdP your organisation plainly does not use is a tell. Name it after a plausible vendor or an acquisition
Rollback: Delete the decoy trust or identity-provider configuration, after confirming nothing references it.
Upkeep: Renew its signing certificate before expiry, like real federations. Quarterly proof-of-life read of the configuration.

Cost

Negligible. Identity-provider and federation objects are configuration rather than billed resources on all three providers. Cost is audit-log ingestion only.

Indicative only. Cloud pricing and licensing change — check the provider's official pricing pages for current rates before you budget.

Technologies

AWSAzureGCP

ATT&CK coverage 8

Technique	Tactic	Status	Confidence	Tier
T1606.002 SAML Tokens	Credential Access	theoretical	weak	T4
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1606.002 SAML Tokens as an adversary behaviour. No source covers decoy SAML signing certificates.
T1556 Modify Authentication Process	Defense Impairment	theoretical	moderate	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Logging management events — AWS CloudTrail User Guide — Control-plane reads and changes are management events, logged by default. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1556 Modify Authentication Process as an adversary behaviour. Changing a decoy identity-provider configuration is a logged control-plane change.
T1482 Domain Trust Discovery	Discovery	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) 4662(S, F) An operation was performed on an object — Event 4662 records operations on an Active Directory object that carries a SACL. Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros et al. rate T1482 as highly feasible for infrastructure deception. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1482 Domain Trust Discovery as an adversary behaviour.
↳ As T1207 — industry-plausible, no dedicated paper.
T1098.005 Device Registration	Persistence	theoretical	weak	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1098.005 Device Registration as an adversary behaviour. No audit signal sourced for device registration on a decoy account.
T1556 Modify Authentication Process	Persistence	theoretical	moderate	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Logging management events — AWS CloudTrail User Guide — Control-plane reads and changes are management events, logged by default. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1556 Modify Authentication Process as an adversary behaviour. Changing a decoy identity-provider configuration is a logged control-plane change.
T1556.006 Multi-Factor Authentication	Persistence	confirmed	strong	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2427 fires on any attribute change to a honeytoken user; Microsoft's own example is changing an account's phone number to capture MFA. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1556.006 Multi-Factor Authentication as an adversary behaviour.
T1556.007 Hybrid Identity	Persistence	theoretical	weak	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1556.007 Hybrid Identity as an adversary behaviour. No audit signal sourced for hybrid-identity tampering on a decoy.
T1484.002 Trust Modification	Privilege Escalation	theoretical	moderate	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Logging management events — AWS CloudTrail User Guide — Control-plane reads and changes (create, attach, modify, delete) are management events, logged by default. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1484.002 Trust Modification as an adversary behaviour.

Evidence

Decoy User Credential (D3-DUC) — MITRE D3FEND standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard

Research basis: MITRE D3FEND D3-DUC / D3-DE cover fake trust configurations at category level only. The DOAR evidence audit rated this technique Moderate on the technique-evidence scale: the mechanism follows from how golden-SAML attacks work, but no dedicated study validates a decoy federation provider specifically.