🖥️ Honey VM Instance

Decoy EC2/VM/GCE instances with realistic services.

→ Explore in ATT&CK matrix (35 mappings) Deployment detail

What it is

A cloud virtual machine that looks like part of the real fleet: same image, agents and naming, exposing only the services its role implies. Attackers scanning or moving laterally treat it as one more host to try. It is a running system, so logins, flow logs and the control-plane calls that name it all show the attacker touching something nobody legitimately uses.

Implementation requirements

AWS: aws ec2 run-instances (or Terraform aws_instance) in a subnet where real workloads live. Azure: az vm create. GCP: gcloud compute instances create. Use the same base image, agents and tags as the real fleet
Expose only the services the instance's role implies (SSH or RDP, a web admin page). No real credentials, data or trust relationships on the host
Monitoring, host: sshd authentication logs or Windows 4624/4625. Network: VPC or VNet flow logs for connections to the instance. Control plane: calls that name the instance, such as ec2:GetPasswordData, ssm:StartSession or ssm:SendCommand, Azure Run Command, or a GCP setMetadata SSH-key push. Listing every instance (DescribeInstances) does not single out the decoy
Safety: the instance profile or managed identity holds no permissions. Deny outbound traffic except to your log collector, so a compromised decoy cannot be used to attack anything
Rebuild from a known-good image after every interaction; treat the old disk as evidence
OPSEC: match the fleet's OS, patch level, hostname scheme and size. A lone unpatched box with nothing else like it is a honeypot tell
Rollback: Snapshot the disk for evidence, then terminate the instance. Remove its DNS records, breadcrumbs and flow-log configuration.
Upkeep: Patch on the fleet's schedule, so it never stands out as the one unpatched host. Monthly proof-of-life connection; rebuild from the golden image after every real touch.

Technologies

AWSCI/CDGCPAzureWindowsLinux

ATT&CK coverage 35

Technique	Tactic	Status	Confidence	Tier
T1074 Data Staged	Collection	theoretical	weak	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1074 Data Staged as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1074 to its Lures activity. Staging into a defender-planted location is not documented attacker behaviour.
T1074.002 Remote Data Staging	Collection	theoretical	weak	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1074.002 Remote Data Staging as an adversary behaviour. Staging into a decoy location is not documented behaviour.
T1105 Ingress Tool Transfer	Command & Control	confirmed	strong	T2
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (2 sources) Cowrie — SSH and Telnet honeypot — Cowrie records files the intruder transfers via SFTP, SCP, wget and curl. Container Orchestration Honeypot: Observing Attacks in the Wild — Attackers on the container honeypot fetched scripts with curl and piped them to bash.
T1212 Exploitation for Credential Access	Credential Access	theoretical	moderate	T2
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (3 sources) Cowrie — SSH and Telnet honeypot — Cowrie logs every session and every shell command an intruder runs on the honeypot. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1212 Exploitation for Credential Access as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1212 to its Lures activity. Exploitation is seen because the vulnerable-looking host is the decoy.
T1552.005 Cloud Instance Metadata API	Credential Access	theoretical	moderate	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (2 sources) Tracebit for AWS — canary resources and credentials — Deploys canary credentials on EC2 instances. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1552.005 Cloud Instance Metadata API as an adversary behaviour. Not specifically through the metadata service.
T1578 Modify Cloud Compute Infrastructure	Defense Impairment	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) MITRE ATT&CK Enterprise v20.0 — Adversaries create, delete or modify instances and snapshots, which can also remove evidence of their presence. Logging management events — AWS CloudTrail User Guide — These are write management events, logged by default. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1578 to its Lures activity. Moderate: behaviour and log signal are documented; no study or product shows honey instances or snapshots specifically.
T1082 System Information Discovery	Discovery	confirmed	strong	T2
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (2 sources) Cowrie — SSH and Telnet honeypot — Cowrie logs every session and every shell command an intruder runs on the honeypot. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1082 System Information Discovery as an adversary behaviour.
T1518 Software Discovery	Discovery	theoretical	weak	T2
↳ Evidence (2 sources) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1518 Software Discovery as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1518 to its Lures activity. Listing installed software touches no decoy.
T1580 Cloud Infrastructure Discovery	Discovery	theoretical	moderate	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — AWS Infrastructure token: creates decoy S3 buckets, SQS queues, SSM parameters, Secrets Manager secrets and DynamoDB tables, and alerts when an attacker interacts with them. Logging management events — AWS CloudTrail User Guide — Describe and Get calls are read management events, logged when read events are enabled. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1580 to its Lures activity. Moderate: a plain List call does not name the decoy. The alert fires when the attacker queries the decoy resource itself, which the token documentation does not break down by API call.
T1673 Virtual Machine Discovery	Discovery	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Hypervisor Jackpotting, Part 2: eCrime Actors Increase Targeting of ESXi Servers with Ransomware — eCrime groups reach ESXi over SSH, list and terminate running VMs, then encrypt /vmfs/volumes. Deception-Based Proactive Defense Against Ransomware in VMware ESXi Systems — An emulated ESXi honeypot with decoy files and services was deployed to lure and observe ransomware. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1673 Virtual Machine Discovery as an adversary behaviour.
T1059 Command and Scripting Interpreter	Execution	confirmed	strong	T2
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (2 sources) Container Orchestration Honeypot: Observing Attacks in the Wild — Attacker shell payloads (bash, base64-decoded scripts) were captured on the container honeypot. Cowrie — SSH and Telnet honeypot — Cowrie logs the shell commands an intruder runs on the SSH/Telnet honeypot.
T1059.004 Unix Shell	Execution	confirmed	strong	T2
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (3 sources) Cowrie — SSH and Telnet honeypot — Cowrie logs every login, shell command and file transfer on the honeypot. Container Orchestration Honeypot: Observing Attacks in the Wild — On Docker/Kubernetes honeypots attackers created privileged containers, Pods and a DaemonSet, ran bash payloads, escaped to the host and planted SSH keys and cron jobs. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1059.004 Unix Shell as an adversary behaviour.
T1059.006 Python	Execution	theoretical	moderate	T2
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (2 sources) Cowrie — SSH and Telnet honeypot — Cowrie logs every login, shell command and file transfer on the honeypot. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1059.006 Python as an adversary behaviour.
T1569 System Services	Execution	theoretical	moderate	T2
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (2 sources) Cowrie — SSH and Telnet honeypot — Cowrie logs every session and every shell command an intruder runs on the honeypot. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1569 System Services as an adversary behaviour.
T1651 Cloud Administration Command	Execution	theoretical	moderate	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros et al. rate T1651 as feasible (medium) for infrastructure deception. Logging management events — AWS CloudTrail User Guide — Control-plane reads and changes are management events, logged by default. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1651 Cloud Administration Command as an adversary behaviour.
T1020.001 Traffic Duplication	Exfiltration	theoretical	weak	T3
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1020.001 Traffic Duplication as an adversary behaviour. No source shows a decoy observing traffic duplication.
T1489 Service Stop	Impact	theoretical	moderate	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Deception Engineering: exploring the use of Windows Service Canaries against ransomware — Prototype Windows service canaries: decoy services that ransomware stops before encrypting; several stopping together triggers the alert. Not tested against live ransomware. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1489 Service Stop as an adversary behaviour. Moderate: the service canary is a published prototype, not yet tested against live ransomware.
T1496 Resource Hijacking	Impact	confirmed	strong	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (4 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — Planted AWS keys were used to launch EC2 instances that mined Monero (474 miners tracked). Docker Honeypot Reveals Cryptojacking as Most Common Cloud Threat — A Docker honeypot received 850 attacks in 50 days; more than 75% were cryptojacking. Container Orchestration Honeypot: Observing Attacks in the Wild — On the Kubernetes honeypot, nearly all attacks aimed solely to run XMRig. MITRE ATT&CK Enterprise v20.0 — T1496.001: TeamTNT, Kinsing and Hildegard mine cryptocurrency on Docker and Kubernetes.
T1496.001 Compute Hijacking	Impact	confirmed	strong	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (4 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — Planted AWS keys were used to launch EC2 instances that mined Monero. Docker Honeypot Reveals Cryptojacking as Most Common Cloud Threat — A Docker honeypot received 850 attacks in 50 days; more than 75% were cryptojacking. Container Orchestration Honeypot: Observing Attacks in the Wild — On Docker/Kubernetes honeypots attackers created privileged containers, Pods and a DaemonSet, ran bash payloads, escaped to the host and planted SSH keys and cron jobs. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1496.001 Compute Hijacking as an adversary behaviour.
T1499 Endpoint Denial of Service	Impact	theoretical	weak	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1499 Endpoint Denial of Service as an adversary behaviour. DoS against a decoy endpoint covers no real endpoint.
T1529 System Shutdown/Reboot	Impact	theoretical	moderate	T2
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (3 sources) Cowrie — SSH and Telnet honeypot — Cowrie logs every session and shell command an intruder runs on the honeypot. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1529 System Shutdown/Reboot as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1529 to its Lures activity.
↳ Detects shutdown of a decoy, not of real systems.
T1133 External Remote Services	Initial Access	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (4 sources) MITRE ATT&CK Enterprise v20.0 — T1133 covers VPN, Citrix and other remote access; procedure example: TeamTNT exploited exposed Docker API ports and kubelets for initial entry. Container Orchestration Honeypot: Observing Attacks in the Wild — Exposed Docker and Kubernetes honeypots on default ports attracted attackers within minutes. Cowrie — SSH and Telnet honeypot — An exposed SSH/Telnet honeypot logs brute-force and successful logins. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1133 to its Lures activity.
T1190 Exploit Public-Facing Application	Initial Access	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (5 sources) An Innovative Security Strategy using Reactive Web Application Honeypot — SNARE and TANNER, a reactive web-application honeypot that answers exploitation attempts. Deception in Dynamic Web Application Honeypots: Case of Glastopf — Glastopf, a web-application honeypot that replies to attacks with the responses attackers expect. Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros et al. rate T1190 as highly feasible for infrastructure deception. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1190 Exploit Public-Facing Application as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1190 to its Lures activity.
T1021 Remote Services	Lateral Movement	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Cowrie — SSH and Telnet honeypot — A widely used SSH/Telnet honeypot (6.6k GitHub stars) that logs every login attempt and session; deployed internally it records lateral SSH attempts. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1021 to its Lures activity.
T1021.008 Direct Cloud VM Connections	Lateral Movement	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Logging management events — AWS CloudTrail User Guide — Control-plane reads and changes (create, attach, modify, delete) are management events, logged by default. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1021.008 Direct Cloud VM Connections as an adversary behaviour. Cloud-API connections to a decoy VM are logged control-plane calls.
T1210 Exploitation of Remote Services	Lateral Movement	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros et al. rate T1210 as highly feasible for infrastructure deception. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1210 Exploitation of Remote Services as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1210 to its Lures activity.
T1563 Remote Service Session Hijacking	Lateral Movement	theoretical	moderate	T2
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (3 sources) Cowrie — SSH and Telnet honeypot — Cowrie logs every session and every shell command an intruder runs on the honeypot. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1563 Remote Service Session Hijacking as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1563 to its Lures activity.
T1098.004 SSH Authorized Keys	Persistence	confirmed	strong	T2
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (2 sources) Container Orchestration Honeypot: Observing Attacks in the Wild — Attackers on the container honeypot generated SSH keys and added them to the host's authorized_keys for persistence. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1098.004 SSH Authorized Keys as an adversary behaviour.
T1133 External Remote Services	Persistence	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Cowrie — SSH and Telnet honeypot — Every login to the exposed SSH/Telnet honeypot is logged, so repeated returns by the same actor are visible. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1133 to its Lures activity.
T1068 Exploitation for Privilege Escalation	Privilege Escalation	theoretical	moderate	T3
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (3 sources) Cowrie — SSH and Telnet honeypot — Cowrie logs every session and shell command an intruder runs on the honeypot. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1068 Exploitation for Privilege Escalation as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1068 to its Lures activity.
T1611 Escape to Host	Privilege Escalation	confirmed	strong	T3
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (1 source) Container Orchestration Honeypot: Observing Attacks in the Wild — Attackers on the honeypot escaped the container to the host (chroot to the host filesystem) and set up persistence there via SSH keys and crontab.
T1216 System Script Proxy Execution	Stealth	theoretical	weak	T2
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (2 sources) Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros et al. rate T1216 as feasible (medium) for infrastructure deception. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1216 System Script Proxy Execution as an adversary behaviour. Attackers use the real system script; a decoy copy is rarely touched.
T1218 System Binary Proxy Execution	Stealth	theoretical	weak	T2
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (2 sources) Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros et al. rate T1218 as feasible (medium) for infrastructure deception. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1218 System Binary Proxy Execution as an adversary behaviour. Attackers use the real System32 binary; a decoy copy is rarely touched.
T1497 Virtualization/Sandbox Evasion	Stealth	theoretical	weak	T2
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1497 Virtualization/Sandbox Evasion as an adversary behaviour. Sandbox checks run inside the attacker's own code.
↳ Inverted logic (a VM that deliberately fails sandbox checks). Clever but unproven.
T1612 Build Image on Host	Stealth	theoretical	moderate	T2
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (2 sources) Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros et al. rate T1612 as feasible (medium) for infrastructure deception. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1612 Build Image on Host as an adversary behaviour.

Evidence

Decoy Network Resource (D3-DNR) — MITRE D3FEND standard
Decoy Environment (D3-DE) — MITRE D3FEND standard
A Virtual Honeypot Framework — Provos, N., USENIX Security Symposium 2004 peer-reviewed
Agentic Cloud Decoys: A Deception-Driven Framework for Autonomous Intrusion Investigation — Manivannan, M.; Alharthi, D., arXiv:2607.24006 2026 peer-reviewed
2023 Honeypotting in the Cloud Report — Orca Security 2023 industry
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard
Cowrie — SSH and Telnet honeypot — Oosterhof, M. (maintainer), Cowrie project (open source) practitioner
Container Orchestration Honeypot: Observing Attacks in the Wild — Spahn, N.; Hanke, N.; Holz, T.; Kruegel, C.; Vigna, G., RAID 2023 peer-reviewed