🗄️ Honey Parameter

Decoy SSM parameters/App Config entries.

→ Explore in ATT&CK matrix (2 mappings) Deployment detail

What it is

A configuration parameter, stored like real settings, whose value is a honeytoken. Parameter stores often hold connection strings and keys, so attackers read them during discovery. Reading the decoy parameter is logged by name; placing it under a path no automation reads makes any read of that path itself suspicious.

Implementation requirements

AWS Systems Manager Parameter Store: a SecureString parameter under a path named like real configuration. Azure App Configuration or a Key Vault reference is the equivalent. Its value is a honeytoken (D006)
Monitoring: Parameter Store API calls (GetParameter, GetParameters, GetParametersByPath) are CloudTrail management events. Alert when the decoy parameter's name appears in the request
Path-wide reads return the decoy along with real parameters. Place it under a path real automation never reads, so a path-wide read of that path is itself suspicious
Safety: nothing legitimate consumes the parameter. OPSEC: version history, tier and description like real parameters
Rollback: Delete the parameter. Revoke the honeytoken stored in it.
Upkeep: Rotate it like real parameters. Monthly proof-of-life read.

Technologies

AWSAzure

ATT&CK coverage 2

Technique	Tactic	Status	Confidence	Tier
T1552 Unsecured Credentials	Credential Access	confirmed	strong	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (4 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted in public GitHub repositories were harvested and used by attackers within minutes. 2023 Honeypotting in the Cloud Report — AWS keys planted in nine kinds of cloud resource were found and used; GitHub keys within 2 minutes, S3 within 8 hours. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1552 to its Lures activity.
T1555.006 Cloud Secrets Management Stores	Credential Access	confirmed	strong	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Tracebit for AWS — canary resources and credentials — Commercial canary Secrets Manager secrets and SSM parameters that alert on access. Deploy and monitor Azure Key Vault honeytokens with Microsoft Sentinel — Microsoft Sentinel decoy keys and secrets in Azure Key Vault; any access raises an alert. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1555.006 Cloud Secrets Management Stores as an adversary behaviour.

Evidence

Decoy Object (D3-DO) — MITRE D3FEND standard
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
Tracebit for AWS — canary resources and credentials — Tracebit industry
Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Thinkst Applied Research industry
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard