🌐 Honey Subnet

Fake subnets within real VPCs for scanning detection.

→ Explore in ATT&CK matrix (5 mappings) Deployment detail

What it is

An unused subnet inside a real network, holding at least one decoy listener. Scanning tools sweep whole address ranges, so they inevitably touch it. Because nothing legitimate connects there, any traffic into the subnet indicates scanning or lateral movement; an empty subnet with no listener would leave no record at all.

Implementation requirements

Create a subnet inside a real VPC or VNet, named and sized like production, that no workload uses
Put at least one decoy listener or network interface in it. Flow logs record traffic at network interfaces, so traffic to an empty subnet leaves no record
Monitoring: flow logs on the decoy subnet. Nothing legitimate connects there, so any flow into it is scanning or lateral movement. Flow logs arrive minutes late; a listener's own log is faster
Safety: route tables and security rules allow inbound traffic to the decoys only, with no outbound path into production
OPSEC: CIDR, tags and route tables consistent with neighbouring subnets
Rollback: Delete the listener or interface, then the subnet. Remove its route-table associations.
Upkeep: Keep it in IPAM as reserved, so nothing is assigned into it. Monthly proof-of-life scan from a test host.

Technologies

Network

ATT&CK coverage 5

Technique	Tactic	Status	Confidence	Tier
T1018 Remote System Discovery	Discovery	confirmed	strong	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) A Virtual Honeypot Framework — Decoy hosts on unused addresses are found, and logged, by an attacker mapping the network. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1018 to its Lures activity.
T1046 Network Service Discovery	Discovery	confirmed	strong	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) A Virtual Honeypot Framework — Honeyd simulates hosts on unallocated addresses and deceives network scanning and fingerprinting tools. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1046 to its Lures activity. Koney: A Cyber Deception Orchestration Framework for Kubernetes — (D029) Koney uses service meshes and eBPF to add traps to containerised applications; probing a trap is logged.
T1580 Cloud Infrastructure Discovery	Discovery	theoretical	moderate	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — AWS Infrastructure token: creates decoy S3 buckets, SQS queues, SSM parameters, Secrets Manager secrets and DynamoDB tables, and alerts when an attacker interacts with them. Logging management events — AWS CloudTrail User Guide — Describe and Get calls are read management events, logged when read events are enabled. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1580 to its Lures activity. Moderate: a plain List call does not name the decoy. The alert fires when the attacker queries the decoy resource itself, which the token documentation does not break down by API call.
T1595 Active Scanning	Reconnaissance	confirmed	strong	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) A Virtual Honeypot Framework — Honeyd simulates hosts on unallocated addresses and deceives network scanning and fingerprinting tools. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1595 to its Lures activity.
T1595.001 Scanning IP Blocks	Reconnaissance	confirmed	strong	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) A Virtual Honeypot Framework — Honeyd simulates hosts on unallocated addresses and deceives scanning tools. The UCSD Network Telescope — The UCSD Network Telescope observes scans directed at a large routed but unused address block. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1595.001 Scanning IP Blocks as an adversary behaviour.

Evidence

Decoy Network Resource (D3-DNR) — MITRE D3FEND standard
A Virtual Honeypot Framework — Provos, N., USENIX Security Symposium 2004 peer-reviewed
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard