🌐 Honey VPC/VNet

Decoy virtual networks appearing as production segments.

→ Explore in ATT&CK matrix (10 mappings) Deployment detail

What it is

A virtual network named and sized like a production segment and reachable from where an intruder would pivot, populated with decoy services. Attackers map and probe networks to find the next target. Nothing legitimate uses the range, so any accepted connection into it, as recorded in flow logs or by the decoys inside, is the signal.

Implementation requirements

Create a VPC or VNet named, tagged and sized like production segments. Make it reachable from the networks an intruder would pivot from
Security rules allow inbound traffic to the decoys and deny outbound traffic into production. Never peer it in a way that gives the decoy network a route to real systems
Populate it with decoy services (D011, D046). An empty network has nothing to touch
Monitoring: flow logs on the decoy network. AWS: 1-minute aggregation. Azure: VNet flow logs. GCP: VPC Flow Logs with the sampling rate set to 100%. Nothing legitimate uses the range, so any accepted flow into it is the signal. Flow logs arrive minutes late
Control plane: DescribeVpcs lists every network and does not single out the decoy. Changes to the decoy's routes, peering or security groups are logged writes and worth alerting on
OPSEC: flow-log and tagging configuration identical to real networks
Rollback: Delete the decoys inside, then the network and its flow logs. Remove any routes or peering created for it.
Upkeep: Review its security rules whenever production network rules change. Monthly proof-of-life connection into the range.

Technologies

CI/CDNetworkAWSAzureGCP

ATT&CK coverage 10

Technique	Tactic	Status	Confidence	Tier
T1040 Network Sniffing	Credential Access	theoretical	moderate	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (3 sources) Automating the Injection of Believable Decoys to Detect Snooping — Peer-reviewed prototype that injects believable bait traffic (credentials) into a campus wireless network to expose eavesdroppers; believability confirmed by a user study. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1040 Network Sniffing as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1040 to its Lures activity.
T1686.001 Cloud Firewall	Defense Impairment	theoretical	moderate
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Logging management events — AWS CloudTrail User Guide — Control-plane reads and changes (create, attach, modify, delete) are management events, logged by default. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1686.001 Cloud Firewall as an adversary behaviour.
T1046 Network Service Discovery	Discovery	confirmed	strong	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) A Virtual Honeypot Framework — Honeyd simulates hosts on unallocated addresses and deceives network scanning and fingerprinting tools. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1046 to its Lures activity. Koney: A Cyber Deception Orchestration Framework for Kubernetes — (D029) Koney uses service meshes and eBPF to add traps to containerised applications; probing a trap is logged.
T1049 System Network Connections Discovery	Discovery	theoretical	weak	T2
↳ Evidence (2 sources) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1049 System Network Connections Discovery as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1049 to its Lures activity. Listing network connections (netstat) touches no decoy and produces no per-object event.
T1580 Cloud Infrastructure Discovery	Discovery	theoretical	moderate	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — AWS Infrastructure token: creates decoy S3 buckets, SQS queues, SSM parameters, Secrets Manager secrets and DynamoDB tables, and alerts when an attacker interacts with them. Logging management events — AWS CloudTrail User Guide — Describe and Get calls are read management events, logged when read events are enabled. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1580 to its Lures activity. Moderate: a plain List call does not name the decoy. The alert fires when the attacker queries the decoy resource itself, which the token documentation does not break down by API call.
T1020.001 Traffic Duplication	Exfiltration	theoretical	weak	T3
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1020.001 Traffic Duplication as an adversary behaviour. No source shows a decoy observing traffic duplication.
T1048 Exfiltration Over Alternative Protocol	Exfiltration	theoretical	weak	T3
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (2 sources) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1048 Exfiltration Over Alternative Protocol as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1048 to its Lures activity. DNS or ICMP exfiltration goes to the attacker's own server; only exfiltration from inside a honey network is seen.
T1133 External Remote Services	Initial Access	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (4 sources) MITRE ATT&CK Enterprise v20.0 — T1133 covers VPN, Citrix and other remote access; procedure example: TeamTNT exploited exposed Docker API ports and kubelets for initial entry. Container Orchestration Honeypot: Observing Attacks in the Wild — Exposed Docker and Kubernetes honeypots on default ports attracted attackers within minutes. Cowrie — SSH and Telnet honeypot — An exposed SSH/Telnet honeypot logs brute-force and successful logins. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1133 to its Lures activity.
T1133 External Remote Services	Persistence	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Cowrie — SSH and Telnet honeypot — Every login to the exposed SSH/Telnet honeypot is logged, so repeated returns by the same actor are visible. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1133 to its Lures activity.
T1535 Unused/Unsupported Cloud Regions	Stealth	theoretical	weak	T4
↳ Evidence (2 sources) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1535 Unused/Unsupported Cloud Regions as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1535 to its Lures activity. Attackers can operate in unused regions without touching an existing decoy.

Evidence

Decoy Network Resource (D3-DNR) — MITRE D3FEND standard
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard