🗄️ Honey Secret

Fake entries in Secrets Manager/Key Vault.

→ Explore in ATT&CK matrix (4 mappings) Deployment detail

What it is

A secret in a secrets manager whose value is itself a honeytoken, such as a credential for an identity that grants nothing. Secret stores are among the first places attackers look once they hold a cloud identity. Reading the decoy secret is logged per secret, even during bulk reads, and using the credential inside it alerts again.

Implementation requirements

AWS: a Secrets Manager secret with an attractive name. Azure: a Key Vault secret. GCP: a Secret Manager secret. Its value is itself a honeytoken (D006) or a credential for a decoy service
Monitoring: AWS logs GetSecretValue in CloudTrail for both single and batch (BatchGetSecretValue) retrieval, so bulk reads still name the decoy. Azure: SecretGet in the Key Vault AuditEvent log via a diagnostic setting. GCP: AccessSecretVersion is a Data Access log; enable DATA_READ for Secret Manager
Listing secrets (ListSecrets, SecretList) returns every name and does not single out the decoy
Safety: the secret and the credential inside it grant nothing. OPSEC: rotation settings, tags and description like real secrets
Rollback: Delete the secret (schedule deletion where recovery windows apply). Revoke the credential inside it.
Upkeep: Rotate it like real secrets. Monthly proof-of-life read.

Technologies

AWSAzureGCP

ATT&CK coverage 4

Technique	Tactic	Status	Confidence	Tier
T1213 Data from Information Repositories	Collection	confirmed	strong	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (5 sources) GitGuardian Honeytoken — core concepts — Production honeytokens placed in code repositories, CI/CD, Docker images, Jira, Confluence and Slack; any use of one raises an alert. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1213 to its Lures activity. Detecting RAG Extraction Attack via Dual-Path Runtime Integrity Game (CanaryRAG) — (D071) CanaryRAG embeds canary tokens in retrieved chunks to detect knowledge-base extraction through the model. Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection — (D051) LLM-integrated applications follow instructions hidden in content they retrieve. LLM Agent Honeypot: Monitoring AI Hacking Agents in the Wild — (D051) Prompt injections embedded in honeypot responses identified AI hacking agents in the wild (8 potential agents over three months).
T1552 Unsecured Credentials	Credential Access	confirmed	strong	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (4 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted in public GitHub repositories were harvested and used by attackers within minutes. 2023 Honeypotting in the Cloud Report — AWS keys planted in nine kinds of cloud resource were found and used; GitHub keys within 2 minutes, S3 within 8 hours. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1552 to its Lures activity.
T1555 Credentials from Password Stores	Credential Access	confirmed	strong	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (6 sources) Tracebit for AWS — canary resources and credentials — Commercial canary Secrets Manager secrets that alert on access. Deploy and monitor Azure Key Vault honeytokens with Microsoft Sentinel — Microsoft Sentinel decoy keys and secrets planted in Azure Key Vault; any access raises an alert. Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — AWS Infrastructure token: decoy Secrets Manager secrets and SSM parameters that alert on interaction. Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros et al. rate T1555 as highly feasible for infrastructure deception. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1555 Credentials from Password Stores as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1555 to its Lures activity.
T1555.006 Cloud Secrets Management Stores	Credential Access	confirmed	strong	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Tracebit for AWS — canary resources and credentials — Commercial canary Secrets Manager secrets and SSM parameters that alert on access. Deploy and monitor Azure Key Vault honeytokens with Microsoft Sentinel — Microsoft Sentinel decoy keys and secrets in Azure Key Vault; any access raises an alert. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1555.006 Cloud Secrets Management Stores as an adversary behaviour.

Evidence

Decoy Object (D3-DO) — MITRE D3FEND standard
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
Tracebit for AWS — canary resources and credentials — Tracebit industry
Deploy and monitor Azure Key Vault honeytokens with Microsoft Sentinel — Microsoft industry
Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Thinkst Applied Research industry
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard