🗄️ Canary File

Tripwire documents (credentials.csv, passwords.xlsx) in storage.

→ Explore in ATT&CK matrix (16 mappings) Deployment detail

What it is

A document named and shaped like something valuable, such as an exported credential list or a finance sheet, containing only fake values. Attackers open or copy files like this on sight. Two tripwires fire independently: the read of that exact file in storage, and a callback from the document itself when it is opened, if it is opened online.

Implementation requirements

Create documents named and shaped like the files they imitate, such as an exported credentials list or a finance spreadsheet. Every value is fake
Tripwire 1, storage: a read of that exact object. S3: CloudTrail data events (GetObject) scoped to the object or bucket. Azure: StorageBlobLogs (GetBlob) via a diagnostic setting. GCS: Data Access logs (storage.objects.get). File servers: a SACL with Audit File System (event 4663), or an auditd rule on the path
Tripwire 2, the document itself: a canarytoken that calls back when the file is opened. Thinkst Canarytokens offers MS Word, MS Excel and PDF types
The open-time callback fails if the file is opened offline or in a viewer that blocks remote content. The storage-level read still fires on download, so deploy both
Safety: the file contains no real data, and any credential in it is itself a honeytoken (D006) that grants nothing
OPSEC: plausible sizes, authors and timestamps. Never reuse the same file name across environments
Rollback: Delete the files from every location they were placed. Deactivate their canarytokens.
Upkeep: Refresh dates and names, so they do not age out of plausibility. Monthly proof-of-life download and open.

Technologies

AWSAzureGCPLinuxWindows

ATT&CK coverage 16

Technique	Tactic	Status	Confidence	Tier
T1005 Data from Local System	Collection	confirmed	strong	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (2 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — MS Word token: alerts whenever the document is opened in Microsoft Office. Copying it does not fire; opening it does. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1005 to its Lures activity.
T1025 Data from Removable Media	Collection	confirmed	strong	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (3 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — MS Word token: alerts whenever the document is opened, wherever it has been taken. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1025 Data from Removable Media as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1025 to its Lures activity.
T1039 Data from Network Shared Drive	Collection	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Network Folder token: alerts whenever the mapped network drive is accessed. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1039 to its Lures activity.
T1119 Automated Collection	Collection	confirmed	strong	T3
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (3 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Document tokens swept up by automated collection alert when the documents are later opened. Using Honeybuckets to Characterize Cloud Storage Scanning in the Wild — Automated scanners in the wild downloaded files from honeybuckets in bulk. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1119 to its Lures activity.
T1530 Data from Cloud Storage	Collection	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (4 sources) Using Honeybuckets to Characterize Cloud Storage Scanning in the Wild — Hundreds of S3 honeybuckets: attackers in the wild downloaded, uploaded and deleted files, and acted on documents they read. 2023 Honeypotting in the Cloud Report — Keys planted in S3 buckets were accessed and used within 8 hours. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1530 to Lures: touching a tripwire resource is easily detectable. Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — (D039) AWS Infrastructure token creates decoy SQS queues that alert when an attacker interacts with them.
T1560 Archive Collected Data	Collection	theoretical	moderate	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (3 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — MS Word token: alerts whenever the document is opened, wherever it has been taken. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1560 Archive Collected Data as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1560 to its Lures activity. Fires when the archived canary is later opened, not when it is archived.
T1552 Unsecured Credentials	Credential Access	confirmed	strong	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (4 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted in public GitHub repositories were harvested and used by attackers within minutes. 2023 Honeypotting in the Cloud Report — AWS keys planted in nine kinds of cloud resource were found and used; GitHub keys within 2 minutes, S3 within 8 hours. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1552 to its Lures activity.
T1552.001 Credentials In Files	Credential Access	confirmed	strong	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (5 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted on GitHub were harvested and used by attackers within minutes. 2023 Honeypotting in the Cloud Report — AWS keys planted in GitHub, S3, ECR, EBS and other resources were found and used; GitHub keys within 2 minutes. GitGuardian Honeytoken — core concepts — Production honeytokens placed in code repositories, CI/CD, Docker images, Jira, Confluence and Slack alert when used. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1552.001 Credentials In Files as an adversary behaviour.
T1222 File and Directory Permissions Modification	Defense Impairment	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) MITRE ATT&CK Enterprise v20.0 — T1222.001 procedure examples: Ryuk, WannaCry and BlackByte run icacls to grant Everyone full access across drives before encrypting. 4670(S) Permissions on an object were changed — Event 4670 records a permission change on an audited file or registry key. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1222 File and Directory Permissions Modification as an adversary behaviour.
T1083 File and Directory Discovery	Discovery	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Windows Directory token: alerts when someone browses the folder in Explorer (via desktop.ini). It does not fire on access that bypasses Explorer. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1083 to its Lures activity.
T1619 Cloud Storage Object Discovery	Discovery	confirmed	strong	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) Using Honeybuckets to Characterize Cloud Storage Scanning in the Wild — Attackers in the wild scanned for and enumerated the honeybuckets, preferring names that looked like real organisations.
T1011 Exfiltration Over Other Network Medium	Exfiltration	theoretical	moderate	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (3 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — MS Word token: alerts whenever the document is opened, wherever it has been taken. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1011 Exfiltration Over Other Network Medium as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1011 to its Lures activity. The canary fires when the stolen file is opened, whatever route took it out; it does not show which medium was used.
T1486 Data Encrypted for Impact	Impact	confirmed	strong	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Ransomware in the honeypot: how we capture keys with sticky canary files — Elastic Endpoint (since 7.14) plants canary files; any process writing to them is flagged as ransomware with high confidence, and since 8.11 its memory is dumped. Deception-Based Proactive Defense Against Ransomware in VMware ESXi Systems — An emulated ESXi honeypot with decoy files and services was deployed to lure and observe ransomware. Hypervisor Jackpotting, Part 2: eCrime Actors Increase Targeting of ESXi Servers with Ransomware — eCrime groups reach ESXi over SSH, list and terminate running VMs, then encrypt /vmfs/volumes.
T1565 Data Manipulation	Impact	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) 4663(S) An attempt was made to access an object — Event 4663 records reads and writes on a file or registry key that carries an audit SACL. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1565 Data Manipulation as an adversary behaviour. Direct when the attacker alters the decoy's own records; database-level audit not yet sourced.
T1080 Taint Shared Content	Lateral Movement	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Network Folder token: any access to the decoy share, including writing to it, raises an alert. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1080 to its Lures activity.
T1570 Lateral Tool Transfer	Lateral Movement	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) 4663(S) An attempt was made to access an object — Event 4663 records reads and writes on a file or registry key that carries an audit SACL. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1570 Lateral Tool Transfer as an adversary behaviour.

Evidence

Decoy File (D3-DF) — MITRE D3FEND standard
Using Honeybuckets to Characterize Cloud Storage Scanning in the Wild — Izhikevich, K.; Voelker, G.; Savage, S.; Izhikevich, L., IEEE EuroS&P 2024 peer-reviewed
Canarytokens — Thinkst Applied Research industry
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Thinkst Applied Research industry
Ransomware in the honeypot: how we capture keys with sticky canary files — Bitam, S.; Alladoum, C., Elastic Security Labs 2024 industry
Baiting Inside Attackers Using Decoy Documents — Bowen, B.; Hershkop, S.; Keromytis, A.; Stolfo, S., SecureComm 2009 peer-reviewed
4663(S) An attempt was made to access an object — Microsoft industry
4670(S) Permissions on an object were changed — Microsoft industry
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard