📦 Honey File Share

Decoy EFS/Azure Files mounts.

→ Explore in ATT&CK matrix (8 mappings) Deployment detail

What it is

A network file share mounted where real shares live, holding fake documents and canary files. File shares are browsed early in an intrusion, because they collect years of sensitive documents. A mount of the decoy share, where the platform logs it, and the files opened inside it give two separate signals.

Implementation requirements

AWS EFS: a file system with mount targets in production subnets. Require IAM authorization in the file-system policy, so every NFS mount produces a NewClientConnection CloudTrail event. Without IAM authorization, mounts produce no CloudTrail event; fall back to flow logs for port 2049 to the mount target
Azure Files: a share in its own storage account, with a diagnostic setting sending StorageFileLogs
Windows file servers: a share with a SACL and Audit Detailed File Share (event 5145)
Content: fake documents and canary files (D018), so a mount leads to a second, file-level tripwire
Safety: read-only, no real data, no shared storage account with real shares. OPSEC: share names and sizes consistent with real shares
Rollback: Unmount, then delete the file system or share and its mount targets. Remove its diagnostic setting or SACL.
Upkeep: Keep file dates moving. Monthly proof-of-life mount.

Technologies

AWSAzureWindows

ATT&CK coverage 8

Technique	Tactic	Status	Confidence	Tier
T1039 Data from Network Shared Drive	Collection	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Network Folder token: alerts whenever the mapped network drive is accessed. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1039 to its Lures activity.
T1135 Network Share Discovery	Discovery	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Network Folder token: alerts when the decoy share is accessed. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1135 to its Lures activity. Moderate: listing share names (net view) does not access the share; the alert fires when the attacker opens it.
T1080 Taint Shared Content	Lateral Movement	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Network Folder token: any access to the decoy share, including writing to it, raises an alert. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1080 to its Lures activity.
T1570 Lateral Tool Transfer	Lateral Movement	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) 4663(S) An attempt was made to access an object — Event 4663 records reads and writes on a file or registry key that carries an audit SACL. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1570 Lateral Tool Transfer as an adversary behaviour.
T1216 System Script Proxy Execution	Stealth	theoretical	weak	T2
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (2 sources) Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros et al. rate T1216 as feasible (medium) for infrastructure deception. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1216 System Script Proxy Execution as an adversary behaviour. Attackers use the real system script; a decoy copy is rarely touched.
T1218 System Binary Proxy Execution	Stealth	theoretical	weak	T2
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (2 sources) Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros et al. rate T1218 as feasible (medium) for infrastructure deception. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1218 System Binary Proxy Execution as an adversary behaviour. Attackers use the real System32 binary; a decoy copy is rarely touched.
T1220 XSL Script Processing	Stealth	theoretical	weak	T2
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (3 sources) Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros et al. rate T1220 as feasible (medium) for infrastructure deception. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1220 XSL Script Processing as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1220 to its Lures activity. Attackers bring their own XSL file.
T1221 Template Injection	Stealth	theoretical	weak	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros et al. rate T1221 as feasible (medium) for infrastructure deception. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1221 Template Injection as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1221 to its Lures activity. Only the post-access variant (modifying an existing template) can touch a decoy.

Evidence

Decoy File (D3-DF) — MITRE D3FEND standard
Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Thinkst Applied Research industry
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
4663(S) An attempt was made to access an object — Microsoft industry
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard