🔑 Honey Cloud Group

Decoy permission groups (e.g., "prod-admin-group").

→ Explore in ATT&CK matrix (7 mappings) Deployment detail

What it is

A decoy permission group with a name implying privileged access, discoverable by anyone enumerating groups in the directory. It catches two distinct behaviours: reconnaissance, when an attacker lists groups looking for a privilege path, and persistence, when an attacker adds a principal they control to a group that sounds powerful. The group grants nothing, so the addition gives them no access while giving you a confirmed signal.

Implementation requirements

AWS: IAM group with an attractive name and an attached policy that grants nothing, or explicitly denies
Azure: Entra ID security group with no role assignments and no application ownership
GCP: Google Group in the organisation with no IAM bindings on real projects
Keep it empty, or seed it only with the decoy identities from D002 and D003 so the membership looks plausible under inspection
Monitoring: CloudTrail AddUserToGroup, ListGroupsForUser and GetGroup; Entra ID group-membership change audit events; GCP group audit logs
OPSEC: match your real group naming convention. A name like prod-admin-group only works if your real groups look like that
Rollback: Delete the group, after confirming it has no members.
Upkeep: Quarterly proof-of-life: a membership read and an add attempt from a test principal.

Cost

Negligible. Groups are free directory objects on all three providers. Cost is audit-log ingestion only.

Indicative only. Cloud pricing and licensing change — check the provider's official pricing pages for current rates before you budget.

Technologies

AWSAzureGCP

ATT&CK coverage 7

Technique	Tactic	Status	Confidence	Tier
T1069 Permission Groups Discovery	Discovery	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2429 'Honeytoken was queried via LDAP'; Microsoft maps it to T1069 and T1069.002. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1069 to its Lures activity.
T1069.002 Domain Groups	Discovery	confirmed	strong	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2429 'Honeytoken was queried via LDAP'; Microsoft maps it to T1069.002 Domain Groups. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1069.002 Domain Groups as an adversary behaviour.
T1069.003 Cloud Groups	Discovery	theoretical	moderate	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Logging management events — AWS CloudTrail User Guide — Control-plane reads and changes (create, attach, modify, delete) are management events, logged by default. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1069.003 Cloud Groups as an adversary behaviour. Listing groups does not name the decoy; reading the decoy group itself does.
T1098 Account Manipulation	Persistence	confirmed	strong	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alerts 2427 (attributes modified) and 2428 (group membership changed) fire on any change to a honeytoken user; Microsoft maps both to T1098. Logging management events — AWS CloudTrail User Guide — IAM AttachRolePolicy is a logged management event, so changes to a decoy IAM role are recorded (cloud decoys: moderate). MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1098 to its Lures activity.
T1098.003 Additional Cloud Roles	Persistence	theoretical	moderate	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Logging management events — AWS CloudTrail User Guide — IAM AttachRolePolicy is a logged management event. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1098.003 Additional Cloud Roles as an adversary behaviour.
T1136 Create Account	Persistence	theoretical	moderate	T4
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (3 sources) Logging management events — AWS CloudTrail User Guide — Control-plane changes (create, modify, delete) are management events, logged by default. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1136 Create Account as an adversary behaviour. The honey credential fires on its first API call; inside a honey cloud account, account creation is seen in-decoy.
T1098 Account Manipulation	Privilege Escalation	confirmed	strong	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alerts 2427 (attributes modified) and 2428 (group membership changed) fire on any change to a honeytoken user; Microsoft maps both to T1098. Logging management events — AWS CloudTrail User Guide — IAM AttachRolePolicy is a logged management event, so changes to a decoy IAM role are recorded (cloud decoys: moderate). MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1098 to its Lures activity.

Evidence

Decoy User Credential (D3-DUC) — MITRE D3FEND standard
Deceptive defense: best practices for identity-based honeytokens in Microsoft Defender for Identity — Microsoft 2023 industry
Logging management events — AWS CloudTrail User Guide — Amazon Web Services industry
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard

Research basis: MITRE D3FEND D3-DUC, with Microsoft's 2024 identity-honeytoken guidance and the Azure-Sentinel HoneyTokens solution as the industry sources. The DOAR evidence audit rated this Moderate on the technique-evidence scale — industry-documented rather than independently studied.