📦 Honey Storage Bucket

Decoy S3/Blob/GCS buckets with attractive names.

→ Explore in ATT&CK matrix (14 mappings) Deployment detail

What it is

A storage bucket named in the normal scheme and filled with fake but plausible files. Storage is a common first target, because buckets often hold backups, exports and credentials. Listing or reading inside the decoy bucket is recorded by data-access logging; listing all buckets in the account does not single it out.

Implementation requirements

AWS: an S3 bucket named in your normal scheme, with Block Public Access on. Azure: a container in its own storage account. GCP: a GCS bucket. Fill it with fake but plausible objects (D018)
Grant no more access than comparable real buckets have. An explicit deny-all returns AccessDenied, which teaches the attacker the bucket is different
Monitoring: S3 CloudTrail data events (GetObject, ListObjects, ListObjectsV2) for the bucket. Azure: a diagnostic setting sending StorageBlobLogs reads. GCS: Data Access logs with DATA_READ. S3 server access logs are a cheaper alternative, but AWS delivers them best-effort, within a few hours
ListBuckets returns every bucket in one call and does not single out the decoy. Listing or reading inside the decoy bucket does
Scoping data-event selectors to the decoy ARN keeps cost down, but the selector itself then lists your decoys. Apply logging the same way to comparable real buckets
Safety: no real data, no public access. OPSEC: tags, region and creation date consistent with real buckets
Rollback: Empty and delete the bucket. Remove its data-event selector or diagnostic setting.
Upkeep: Refresh object dates occasionally, so the content does not look abandoned. Monthly proof-of-life read of one object.

Technologies

AWSAzureGCP

ATT&CK coverage 14

Technique	Tactic	Status	Confidence	Tier
T1074 Data Staged	Collection	theoretical	weak	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1074 Data Staged as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1074 to its Lures activity. Staging into a defender-planted location is not documented attacker behaviour.
T1074.002 Remote Data Staging	Collection	theoretical	weak	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1074.002 Remote Data Staging as an adversary behaviour. Staging into a decoy location is not documented behaviour.
T1119 Automated Collection	Collection	confirmed	strong	T3
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (3 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Document tokens swept up by automated collection alert when the documents are later opened. Using Honeybuckets to Characterize Cloud Storage Scanning in the Wild — Automated scanners in the wild downloaded files from honeybuckets in bulk. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1119 to its Lures activity.
T1530 Data from Cloud Storage	Collection	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (4 sources) Using Honeybuckets to Characterize Cloud Storage Scanning in the Wild — Hundreds of S3 honeybuckets: attackers in the wild downloaded, uploaded and deleted files, and acted on documents they read. 2023 Honeypotting in the Cloud Report — Keys planted in S3 buckets were accessed and used within 8 hours. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1530 to Lures: touching a tripwire resource is easily detectable. Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — (D039) AWS Infrastructure token creates decoy SQS queues that alert when an attacker interacts with them.
T1222 File and Directory Permissions Modification	Defense Impairment	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) MITRE ATT&CK Enterprise v20.0 — T1222.001 procedure examples: Ryuk, WannaCry and BlackByte run icacls to grant Everyone full access across drives before encrypting. 4670(S) Permissions on an object were changed — Event 4670 records a permission change on an audited file or registry key. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1222 File and Directory Permissions Modification as an adversary behaviour.
T1135 Network Share Discovery	Discovery	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Network Folder token: alerts when the decoy share is accessed. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1135 to its Lures activity. Moderate: listing share names (net view) does not access the share; the alert fires when the attacker opens it.
T1526 Cloud Service Discovery	Discovery	theoretical	moderate	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — AWS Infrastructure token: decoy cloud resources that alert when an attacker interacts with them. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1526 to deception activities. Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — (D039) AWS Infrastructure token creates decoy SQS queues that alert when an attacker interacts with them. Moderate: discovering that a service exists does not necessarily touch a decoy resource in it.
T1580 Cloud Infrastructure Discovery	Discovery	theoretical	moderate	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — AWS Infrastructure token: creates decoy S3 buckets, SQS queues, SSM parameters, Secrets Manager secrets and DynamoDB tables, and alerts when an attacker interacts with them. Logging management events — AWS CloudTrail User Guide — Describe and Get calls are read management events, logged when read events are enabled. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1580 to its Lures activity. Moderate: a plain List call does not name the decoy. The alert fires when the attacker queries the decoy resource itself, which the token documentation does not break down by API call.
T1619 Cloud Storage Object Discovery	Discovery	confirmed	strong	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) Using Honeybuckets to Characterize Cloud Storage Scanning in the Wild — Attackers in the wild scanned for and enumerated the honeybuckets, preferring names that looked like real organisations.
T1537 Transfer Data to Cloud Account	Exfiltration	theoretical	weak	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1537 Transfer Data to Cloud Account as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1537 to its Lures activity. Transfers to the attacker's own account touch no decoy, unless a decoy snapshot or bucket is shared out.
T1485 Data Destruction	Impact	theoretical	moderate	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (4 sources) Logging management events — AWS CloudTrail User Guide — Control-plane changes (create, modify, delete) are management events, logged by default. Logging data events — AWS CloudTrail User Guide — S3 object operations and Lambda Invoke are data events, logged only once data-event logging is enabled. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1485 Data Destruction as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1485 to its Lures activity. Deleting a decoy snapshot or database is a management event; deleting objects in a decoy bucket needs data events enabled.
T1486 Data Encrypted for Impact	Impact	confirmed	strong	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Ransomware in the honeypot: how we capture keys with sticky canary files — Elastic Endpoint (since 7.14) plants canary files; any process writing to them is flagged as ransomware with high confidence, and since 8.11 its memory is dumped. Deception-Based Proactive Defense Against Ransomware in VMware ESXi Systems — An emulated ESXi honeypot with decoy files and services was deployed to lure and observe ransomware. Hypervisor Jackpotting, Part 2: eCrime Actors Increase Targeting of ESXi Servers with Ransomware — eCrime groups reach ESXi over SSH, list and terminate running VMs, then encrypt /vmfs/volumes.
T1491.002 External Defacement	Impact	theoretical	weak	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1491.002 External Defacement as an adversary behaviour. Defacing a decoy property needs access that would already have alerted.
T1080 Taint Shared Content	Lateral Movement	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Network Folder token: any access to the decoy share, including writing to it, raises an alert. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1080 to its Lures activity.

Evidence

Decoy File (D3-DF) — MITRE D3FEND standard
Using Honeybuckets to Characterize Cloud Storage Scanning in the Wild — Izhikevich, K.; Voelker, G.; Savage, S.; Izhikevich, L., IEEE EuroS&P 2024 peer-reviewed
2023 Honeypotting in the Cloud Report — Orca Security 2023 industry
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
Logging data events — AWS CloudTrail User Guide — Amazon Web Services industry
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard
Tracebit for AWS — canary resources and credentials — Tracebit industry
Agentic Cloud Decoys: A Deception-Driven Framework for Autonomous Intrusion Investigation — Manivannan, M.; Alharthi, D., arXiv:2607.24006 2026 peer-reviewed
Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Thinkst Applied Research industry