🎫 Honey Certificate

Decoy TLS/auth certificates in key stores.

→ Explore in ATT&CK matrix (4 mappings) Deployment detail

What it is

A decoy certificate in a key store, or a certificate credential on an app registration that has no role assignments. Certificates authenticate services and are rarely watched, which makes them attractive to steal. Reading the certificate is logged by the key store, and signing in with it is logged as a service principal sign-in.

Implementation requirements

Azure: a certificate credential on an app registration with no role assignments. Any sign-in with it appears in the service principal sign-in logs. Thinkst Canarytokens offers this as its Azure Login Certificate token
Key stores: a certificate in Key Vault, ACM or Certificate Manager with an attractive subject name. Key Vault records CertificateGet and, for the private key, SecretGet in its AuditEvent log
If the certificate is meant to be presented in TLS, it needs a valid chain for a decoy host name you control, and the handshake log on that host is the signal
Safety: the certificate authenticates nothing real, and its private key exists nowhere else
OPSEC: issuer, validity period and key size like your real certificates
Rollback: Remove the certificate credential from the app registration and delete the certificate from the key store. Revoke it if it was issued by a CA.
Upkeep: Renew before expiry, matching real certificate lifetimes. Quarterly proof-of-life sign-in or read.

Technologies

AzureAWSGCP

ATT&CK coverage 4

Technique	Tactic	Status	Confidence	Tier
T1606.002 SAML Tokens	Credential Access	theoretical	weak	T4
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1606.002 SAML Tokens as an adversary behaviour. No source covers decoy SAML signing certificates.
T1649 Steal or Forge Authentication Certificates	Credential Access	confirmed	strong	T4
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (3 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Azure login certificate token: a fake certificate and config that alert if anyone uses them to log in to Azure. Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros et al. rate T1649 as highly feasible for infrastructure deception. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1649 Steal or Forge Authentication Certificates as an adversary behaviour.
T1550 Use Alternate Authentication Material	Lateral Movement	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (4 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Kubeconfig token: any attempt to use the fake kubeconfig against its API server alerts. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1550 Use Alternate Authentication Material as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1550 to its Lures activity.
T1098.001 Additional Cloud Credentials	Persistence	theoretical	moderate	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Logging management events — AWS CloudTrail User Guide — Control-plane reads and changes (create, attach, modify, delete) are management events, logged by default. Microsoft Entra security operations for applications — Microsoft Entra audit logs record credentials added to existing applications. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1098.001 Additional Cloud Credentials as an adversary behaviour.

Evidence

Decoy User Credential (D3-DUC) — MITRE D3FEND standard
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard
Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Thinkst Applied Research industry