🌐 Honey DNS Record

Fake internal DNS entries resolving to honeypots.

→ Explore in ATT&CK matrix (3 mappings) Deployment detail

What it is

An internal DNS record, named like a real service, that resolves to a decoy. Attackers look up names to find servers worth attacking. Resolving the decoy name is recorded in DNS query logs, and the follow-up connection is recorded by the decoy it points to.

Implementation requirements

Add records in an internal zone (Route 53 private hosted zone, Azure Private DNS, Cloud DNS private zone, or Windows DNS) that resolve to decoys, named like real services
Monitoring, resolution: AWS Route 53 Resolver query logging; Azure DNS resolver policy logs; GCP Cloud DNS logging enabled through a DNS server policy; on Windows DNS, the analytical query log. A lookup of the decoy name is the first signal
Monitoring, connection: the decoy the record points to (D011, D046) logs the follow-up connection
Zone transfers and bulk enumeration return every record and do not single out the decoy. Restrict zone transfers in any case
Safety: never point a decoy name at a real system. OPSEC: TTLs and naming like real records
Rollback: Delete the records. Remove the decoy they point to, if it was created only for them.
Upkeep: Check after every DNS migration that the records and query logging survived. Monthly proof-of-life lookup.

Technologies

AWSAzureGCPNetworkWindows

ATT&CK coverage 3

Technique	Tactic	Status	Confidence	Tier
T1046 Network Service Discovery	Discovery	confirmed	strong	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) A Virtual Honeypot Framework — Honeyd simulates hosts on unallocated addresses and deceives network scanning and fingerprinting tools. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1046 to its Lures activity. Koney: A Cyber Deception Orchestration Framework for Kubernetes — (D029) Koney uses service meshes and eBPF to add traps to containerised applications; probing a trap is logged.
T1048 Exfiltration Over Alternative Protocol	Exfiltration	theoretical	weak	T3
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (2 sources) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1048 Exfiltration Over Alternative Protocol as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1048 to its Lures activity. DNS or ICMP exfiltration goes to the attacker's own server; only exfiltration from inside a honey network is seen.
T1590 Gather Victim Network Information	Reconnaissance	theoretical	moderate	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (3 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — DNS token: anyone resolving the decoy hostname triggers an alert. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1590 Gather Victim Network Information as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1590 to its Lures activity.
↳ Decoy Persona (D3-DP) is an exact match, but recon-stage deception has low real-world feasibility.

Evidence

Decoy Network Resource (D3-DNR) — MITRE D3FEND standard
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Thinkst Applied Research industry
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard