📦 Honey Snapshot/Volume

Fake EBS/disk snapshots containing tainted data.

→ Explore in ATT&CK matrix (2 mappings) Deployment detail

What it is

A disk snapshot named like a production disk and built from synthetic data and honeytokens. Attackers share or copy snapshots to mount them elsewhere and read the data offline. Sharing, copying or creating a volume from the snapshot are logged writes in the owner's account; once it is shared, reads in the other account are no longer visible to you.

Implementation requirements

AWS: an EBS snapshot named like a production disk, created from a volume holding synthetic data and honeytokens (D006, D018). Azure: a managed-disk snapshot. GCP: a persistent-disk snapshot
Monitoring, owner account: sharing it (ModifySnapshotAttribute adding an account), copying it (CopySnapshot) or creating a volume from it (CreateVolume naming the snapshot) are logged writes. Direct reads through the EBS direct APIs (ListSnapshotBlocks, GetSnapshotBlock) are CloudTrail data events; enable them for the decoy
Known limit: once the snapshot is shared, reads made in the other account do not appear in yours. Alert on the share itself; the honeytokens inside fire later if used
Safety: synthetic data only, never a copy of a production disk. OPSEC: size, encryption and tags like real snapshots
Rollback: Delete the snapshot, after confirming no share to another account exists. Revoke the honeytokens inside it.
Upkeep: Recreate it periodically, so its date matches the backup cycle. Quarterly proof-of-life share attempt from a test principal.

Technologies

AWSAzureGCP

ATT&CK coverage 2

Technique	Tactic	Status	Confidence	Tier
T1578 Modify Cloud Compute Infrastructure	Defense Impairment	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) MITRE ATT&CK Enterprise v20.0 — Adversaries create, delete or modify instances and snapshots, which can also remove evidence of their presence. Logging management events — AWS CloudTrail User Guide — These are write management events, logged by default. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1578 to its Lures activity. Moderate: behaviour and log signal are documented; no study or product shows honey instances or snapshots specifically.
T1578.001 Create Snapshot	Defense Impairment	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Logging management events — AWS CloudTrail User Guide — Control-plane reads and changes (create, attach, modify, delete) are management events, logged by default. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1578.001 Create Snapshot as an adversary behaviour.

Evidence

Decoy File (D3-DF) — MITRE D3FEND standard
Logging management events — AWS CloudTrail User Guide — Amazon Web Services industry
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard
2023 Honeypotting in the Cloud Report — Orca Security 2023 industry