🖥️ Honey Lambda/Function

Decoy serverless functions that report callers.

→ Explore in ATT&CK matrix (6 mappings) Deployment detail

What it is

A serverless function with an attractive name, such as a key-rotation or admin task, whose execution role grants nothing. Attackers enumerate functions to read their code and configuration for secrets, or invoke them to see what they do. Reading or invoking the decoy function is logged and names it directly.

Implementation requirements

AWS: a Lambda function with an attractive name (for example, one that sounds like a key-rotation or admin task). Azure: a Function App function. GCP: a Cloud Run function. The execution role or identity grants nothing
Monitoring, invocation: Lambda Invoke is a CloudTrail data event; enable it for the decoy function's ARN. For HTTP-triggered functions, also log every request in the function itself
Monitoring, inspection: reading the code or configuration (GetFunction, GetFunctionConfiguration) is a read-only management event and names the function
The function can report each call it receives to your collector, with source IP and headers. Keep that path simple and rate-limited
Safety: no environment variables holding real secrets; any secret in it is a honeytoken (D006). OPSEC: runtime, memory size and last-modified date like real functions
Rollback: Delete the function and its execution role. Remove the data-event selector for its ARN.
Upkeep: Keep the runtime version current, because deprecated runtimes stand out. Monthly proof-of-life invocation.

Technologies

AWSAzureGCP

ATT&CK coverage 6

Technique	Tactic	Status	Confidence	Tier
T1526 Cloud Service Discovery	Discovery	theoretical	moderate	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — AWS Infrastructure token: decoy cloud resources that alert when an attacker interacts with them. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1526 to deception activities. Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — (D039) AWS Infrastructure token creates decoy SQS queues that alert when an attacker interacts with them. Moderate: discovering that a service exists does not necessarily touch a decoy resource in it.
T1059.006 Python	Execution	theoretical	moderate	T2
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (2 sources) Cowrie — SSH and Telnet honeypot — Cowrie logs every login, shell command and file transfer on the honeypot. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1059.006 Python as an adversary behaviour.
T1648 Serverless Execution	Execution	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Logging data events — AWS CloudTrail User Guide — S3 object operations and Lambda Invoke are data events, logged only once data-event logging is enabled. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1648 Serverless Execution as an adversary behaviour. Lambda Invoke is a data event: the decoy only fires if data-event logging is on for it.
T1489 Service Stop	Impact	theoretical	moderate	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Deception Engineering: exploring the use of Windows Service Canaries against ransomware — Prototype Windows service canaries: decoy services that ransomware stops before encrypting; several stopping together triggers the alert. Not tested against live ransomware. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1489 Service Stop as an adversary behaviour. Moderate: the service canary is a published prototype, not yet tested against live ransomware.
T1496 Resource Hijacking	Impact	confirmed	strong	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (4 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — Planted AWS keys were used to launch EC2 instances that mined Monero (474 miners tracked). Docker Honeypot Reveals Cryptojacking as Most Common Cloud Threat — A Docker honeypot received 850 attacks in 50 days; more than 75% were cryptojacking. Container Orchestration Honeypot: Observing Attacks in the Wild — On the Kubernetes honeypot, nearly all attacks aimed solely to run XMRig. MITRE ATT&CK Enterprise v20.0 — T1496.001: TeamTNT, Kinsing and Hildegard mine cryptocurrency on Docker and Kubernetes.
T1546 Event Triggered Execution	Persistence	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Logging management events — AWS CloudTrail User Guide — Control-plane changes (create, modify, delete) are management events, logged by default. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1546 Event Triggered Execution as an adversary behaviour. Direct only when the attacker modifies an existing decoy rule; creating a new rule touches no decoy.

Evidence

Decoy Environment (D3-DE) — MITRE D3FEND standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
Logging data events — AWS CloudTrail User Guide — Amazon Web Services industry