🎫 Honey Session Token

Planted fake STS/OAuth session tokens.

→ Explore in ATT&CK matrix (10 mappings) Deployment detail

What it is

Short-lived cloud session credentials or OAuth tokens, issued by an identity that grants nothing and planted where tooling caches them. Attackers prize live sessions because they skip the login step entirely. Any call made with the planted token is logged under that session, but the token expires, so it must be re-issued to stay useful as a lure.

Implementation requirements

AWS: from a decoy IAM user or role with no permissions, issue temporary credentials (aws sts get-session-token, valid 15 minutes to 36 hours, or aws sts assume-role). Plant them where tooling caches them, such as an aws_session_token entry in ~/.aws/credentials
Temporary credentials expire, and an expired token gives you no reliable signal. Automate re-issuing so a fresh token is always in place
Monitoring: CloudTrail events whose access key ID is the planted temporary key (it starts with ASIA), or whose principal is the decoy user or role
OAuth and SaaS: plant a token only for a decoy account that holds nothing. Alert on any sign-in or token use by that account in Entra sign-in logs or Google Workspace login and OAuth logs. Those logs arrive minutes to hours late
Safety: the issuing identity grants nothing, so the token grants nothing. OPSEC: session names and expiry times like those your real tooling produces
Rollback: Stop the re-issuing job, then delete the decoy user or role. Remove planted token files.
Upkeep: The re-issuing job is the upkeep: alert if it fails, because an expired token is a dead lure. Weekly proof-of-life use of the current token.

Technologies

AWSAzure

ATT&CK coverage 10

Technique	Tactic	Status	Confidence	Tier
T1528 Steal Application Access Token	Credential Access	theoretical	moderate	T4
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (3 sources) AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1528 Steal Application Access Token as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1528 to its Lures activity. A stolen honey token fires when it is used, not when it is stolen.
T1078 Valid Accounts	Initial Access	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (5 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted on GitHub were used by attackers within minutes (DescribeRegions, then RunInstances). 2023 Honeypotting in the Cloud Report — AWS keys planted across nine cloud resource types were used; GitHub keys within 2 minutes. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2014: any sign-in by a honeytoken account raises an alert. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1078 to its Lures activity.
T1078.004 Cloud Accounts	Initial Access	confirmed	strong	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (4 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted on GitHub were harvested and used by attackers within minutes. 2023 Honeypotting in the Cloud Report — AWS keys planted in GitHub, S3, ECR, EBS and other resources were found and used; GitHub keys within 2 minutes. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1078.004 Cloud Accounts as an adversary behaviour.
T1021.007 Cloud Services	Lateral Movement	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted on GitHub were harvested and used by attackers within minutes. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1021.007 Cloud Services as an adversary behaviour.
T1550 Use Alternate Authentication Material	Lateral Movement	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (4 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Kubeconfig token: any attempt to use the fake kubeconfig against its API server alerts. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1550 Use Alternate Authentication Material as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1550 to its Lures activity.
T1550.001 Application Access Token	Lateral Movement	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Kubeconfig token: any attempt to use the fake kubeconfig against its API server alerts. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1550.001 Application Access Token as an adversary behaviour.
T1550.004 Web Session Cookie	Lateral Movement	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Browser Honeytoken Detection for Infostealers — Replaying a stolen synthetic session cookie against the decoy portal fires the alert, with the machine it was planted on. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1550.004 Web Session Cookie as an adversary behaviour.
T1548.005 Temporary Elevated Cloud Access	Privilege Escalation	theoretical	moderate	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Tracebit for AWS — canary resources and credentials — Commercial canary IAM roles alert when assumed. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1548.005 Temporary Elevated Cloud Access as an adversary behaviour. Assuming a decoy role is closer to T1078.004; the T1548.005 fit is partial.
T1078 Valid Accounts	Stealth	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (5 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted on GitHub were used by attackers within minutes (DescribeRegions, then RunInstances). 2023 Honeypotting in the Cloud Report — AWS keys planted across nine cloud resource types were used; GitHub keys within 2 minutes. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2014: any sign-in by a honeytoken account raises an alert. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1078 to its Lures activity.
T1134 Access Token Manipulation	Stealth	theoretical	moderate	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (2 sources) Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2014: any authentication activity by a honeytoken account raises an alert. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1134 Access Token Manipulation as an adversary behaviour.

Evidence

Decoy User Credential (D3-DUC) — MITRE D3FEND standard
Decoy Session Token (D3-DST) — MITRE D3FEND standard
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard
Browser Honeytoken Detection for Infostealers — Hookset 2026 industry