🗄️ Honey Database

Decoy RDS/DynamoDB/CosmosDB with fake PII data.

→ Explore in ATT&CK matrix (8 mappings) Deployment detail

What it is

A small database, or a decoy table inside a real one, holding generated records that look like personal data. Databases are a prime target for theft and extortion. Logins and queries are recorded by the database engine's own audit logging, which has to be switched on; the cloud control-plane log does not record SQL activity.

Implementation requirements

Deploy a small managed instance (RDS, Azure SQL, Cloud SQL) or a decoy table inside an existing database, filled with generated records that look like personal data. Never copy production data
Monitoring happens in the database engine, not CloudTrail: CloudTrail records control-plane calls (ModifyDBInstance, CreateDBSnapshot) but not SQL logins or queries. Enable engine logging, such as PostgreSQL log_connections plus pgAudit object auditing on the decoy tables, or a SQL Server audit with a database audit specification, and ship the log to your collector
DynamoDB: CloudTrail data events (GetItem, Query, Scan) for the decoy table. Cosmos DB: the DataPlaneRequests diagnostic category
Safety: credentials unique to the decoy, and no network path from it to production. Mark the synthetic records internally, so a later public leak can be recognised as decoy data and not reported as a breach
OPSEC: instance class, engine version and naming like real databases; a table name that matches your schema conventions
Rollback: Take a final snapshot for evidence, then delete the instance or decoy table. Remove its audit configuration and credentials.
Upkeep: Patch the engine with the fleet. Monthly proof-of-life login and query.

Technologies

AWSAzureGCP

ATT&CK coverage 8

Technique	Tactic	Status	Confidence	Tier
T1119 Automated Collection	Collection	confirmed	strong	T3
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (3 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Document tokens swept up by automated collection alert when the documents are later opened. Using Honeybuckets to Characterize Cloud Storage Scanning in the Wild — Automated scanners in the wild downloaded files from honeybuckets in bulk. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1119 to its Lures activity.
T1213 Data from Information Repositories	Collection	confirmed	strong	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (5 sources) GitGuardian Honeytoken — core concepts — Production honeytokens placed in code repositories, CI/CD, Docker images, Jira, Confluence and Slack; any use of one raises an alert. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1213 to its Lures activity. Detecting RAG Extraction Attack via Dual-Path Runtime Integrity Game (CanaryRAG) — (D071) CanaryRAG embeds canary tokens in retrieved chunks to detect knowledge-base extraction through the model. Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection — (D051) LLM-integrated applications follow instructions hidden in content they retrieve. LLM Agent Honeypot: Monitoring AI Hacking Agents in the Wild — (D051) Prompt injections embedded in honeypot responses identified AI hacking agents in the wild (8 potential agents over three months).
T1213.006 Databases	Collection	confirmed	strong	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Tracebit for AWS — canary resources and credentials — Commercial canary DynamoDB tables that alert on access. Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — AWS Infrastructure token (decoy DynamoDB tables) and MySQL dump token (fires when the decoy dump is restored). MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1213.006 Databases as an adversary behaviour.
T1526 Cloud Service Discovery	Discovery	theoretical	moderate	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — AWS Infrastructure token: decoy cloud resources that alert when an attacker interacts with them. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1526 to deception activities. Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — (D039) AWS Infrastructure token creates decoy SQS queues that alert when an attacker interacts with them. Moderate: discovering that a service exists does not necessarily touch a decoy resource in it.
T1485 Data Destruction	Impact	theoretical	moderate	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (4 sources) Logging management events — AWS CloudTrail User Guide — Control-plane changes (create, modify, delete) are management events, logged by default. Logging data events — AWS CloudTrail User Guide — S3 object operations and Lambda Invoke are data events, logged only once data-event logging is enabled. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1485 Data Destruction as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1485 to its Lures activity. Deleting a decoy snapshot or database is a management event; deleting objects in a decoy bucket needs data events enabled.
T1486 Data Encrypted for Impact	Impact	confirmed	strong	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Ransomware in the honeypot: how we capture keys with sticky canary files — Elastic Endpoint (since 7.14) plants canary files; any process writing to them is flagged as ransomware with high confidence, and since 8.11 its memory is dumped. Deception-Based Proactive Defense Against Ransomware in VMware ESXi Systems — An emulated ESXi honeypot with decoy files and services was deployed to lure and observe ransomware. Hypervisor Jackpotting, Part 2: eCrime Actors Increase Targeting of ESXi Servers with Ransomware — eCrime groups reach ESXi over SSH, list and terminate running VMs, then encrypt /vmfs/volumes.
T1565 Data Manipulation	Impact	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) 4663(S) An attempt was made to access an object — Event 4663 records reads and writes on a file or registry key that carries an audit SACL. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1565 Data Manipulation as an adversary behaviour. Direct when the attacker alters the decoy's own records; database-level audit not yet sourced.
T1657 Financial Theft	Impact	theoretical	weak	T4
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1657 Financial Theft as an adversary behaviour. Financial theft is an outcome; access to decoy billing data is collection.

Evidence

Decoy Object (D3-DO) — MITRE D3FEND standard
Decoy Environment (D3-DE) — MITRE D3FEND standard
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard
Tracebit for AWS — canary resources and credentials — Tracebit industry
Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Thinkst Applied Research industry