🌐 Honey Security Group

Decoy SGs with seemingly permissive rules.

→ Explore in ATT&CK matrix (2 mappings) Deployment detail

What it is

A security group or network rule set with seemingly permissive rules, attached to nothing real. To an attacker it looks like an easy way to open access. Attempts to attach it to a resource or edit its rules are logged writes; listing all groups does not single it out.

Implementation requirements

Create a security group or NSG with seemingly permissive rules (broad SSH or RDP ingress), attached to nothing or only to decoy interfaces
Monitoring: attempts to attach it to a real instance or interface (ModifyInstanceAttribute, ModifyNetworkInterfaceAttribute, or the equivalent Azure and GCP writes naming the decoy), and edits to its rules. These are logged writes
Listing groups (DescribeSecurityGroups) returns every group and does not single out the decoy
Posture tools (AWS Config, Security Hub, Defender for Cloud) will flag the permissive rule. Document the exception, and keep the suppression out of shared dashboards, so the suppression list does not reveal the decoy
Safety: never attach it to a real workload
Rollback: Delete the group, after confirming nothing is attached to it. Remove its posture-tool exception.
Upkeep: Review the exception at each posture-tool policy update. Quarterly proof-of-life attach attempt from a test principal.

Technologies

NetworkAWSAzureGCP

ATT&CK coverage 2

Technique	Tactic	Status	Confidence	Tier
T1686.001 Cloud Firewall	Defense Impairment	theoretical	moderate
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Logging management events — AWS CloudTrail User Guide — Control-plane reads and changes (create, attach, modify, delete) are management events, logged by default. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1686.001 Cloud Firewall as an adversary behaviour.
T1046 Network Service Discovery	Discovery	confirmed	strong	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) A Virtual Honeypot Framework — Honeyd simulates hosts on unallocated addresses and deceives network scanning and fingerprinting tools. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1046 to its Lures activity. Koney: A Cyber Deception Orchestration Framework for Kubernetes — (D029) Koney uses service meshes and eBPF to add traps to containerised applications; probing a trap is logged.

Evidence

Decoy Network Resource (D3-DNR) — MITRE D3FEND standard
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard