🔌 Honey API Endpoint

Fake REST/GraphQL endpoints on API Gateway.

→ Explore in ATT&CK matrix (10 mappings) Deployment detail

What it is

An undocumented API route, such as an admin-looking or debug-looking path, that no legitimate client calls. Attackers probe APIs for hidden endpoints that skip normal checks. The route is backed by no real system, and any request to it is recorded in the API's access log.

Implementation requirements

Add an undocumented route to a real API (an admin-looking or debug-looking path, or a decoy GraphQL field) that no legitimate client calls
Back it with no real system: an API Gateway mock integration or a stub handler that returns a plausible 401 or fake data
Monitoring: API Gateway access logs, Azure API Management gateway logs, or the application's own request log. Any request to the route alerts. WAF logs give a second, independent record
Breadcrumbs (D040) such as a stale OpenAPI file or a client-side reference make the route discoverable
Safety: no backend integration, and rate limits in place. OPSEC: headers, timing and error format identical to real routes
Rollback: Remove the route and its mock integration. Remove breadcrumbs that point to it.
Upkeep: Keep it in the API's deployment pipeline, so a redeploy does not silently drop it. Monthly proof-of-life request.

Technologies

ApplicationAWSAzure

ATT&CK coverage 10

Technique	Tactic	Status	Confidence	Tier
T1105 Ingress Tool Transfer	Command & Control	confirmed	strong	T2
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (2 sources) Cowrie — SSH and Telnet honeypot — Cowrie records files the intruder transfers via SFTP, SCP, wget and curl. Container Orchestration Honeypot: Observing Attacks in the Wild — Attackers on the container honeypot fetched scripts with curl and piped them to bash.
T1526 Cloud Service Discovery	Discovery	theoretical	moderate	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — AWS Infrastructure token: decoy cloud resources that alert when an attacker interacts with them. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1526 to deception activities. Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — (D039) AWS Infrastructure token creates decoy SQS queues that alert when an attacker interacts with them. Moderate: discovering that a service exists does not necessarily touch a decoy resource in it.
T1648 Serverless Execution	Execution	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Logging data events — AWS CloudTrail User Guide — S3 object operations and Lambda Invoke are data events, logged only once data-event logging is enabled. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1648 Serverless Execution as an adversary behaviour. Lambda Invoke is a data event: the decoy only fires if data-event logging is on for it.
T1567 Exfiltration Over Web Service	Exfiltration	theoretical	weak	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1567 Exfiltration Over Web Service as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1567 to its Lures activity. No evidence attackers exfiltrate to a webhook found in code; they use services they control.
T1491 Defacement	Impact	theoretical	weak	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1491 Defacement as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1491 to its Lures activity. Defacing decoy routes needs write access that would already have alerted.
T1491.002 External Defacement	Impact	theoretical	weak	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1491.002 External Defacement as an adversary behaviour. Defacing a decoy property needs access that would already have alerted.
T1499 Endpoint Denial of Service	Impact	theoretical	weak	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1499 Endpoint Denial of Service as an adversary behaviour. DoS against a decoy endpoint covers no real endpoint.
T1133 External Remote Services	Initial Access	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (4 sources) MITRE ATT&CK Enterprise v20.0 — T1133 covers VPN, Citrix and other remote access; procedure example: TeamTNT exploited exposed Docker API ports and kubelets for initial entry. Container Orchestration Honeypot: Observing Attacks in the Wild — Exposed Docker and Kubernetes honeypots on default ports attracted attackers within minutes. Cowrie — SSH and Telnet honeypot — An exposed SSH/Telnet honeypot logs brute-force and successful logins. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1133 to its Lures activity.
T1190 Exploit Public-Facing Application	Initial Access	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (5 sources) An Innovative Security Strategy using Reactive Web Application Honeypot — SNARE and TANNER, a reactive web-application honeypot that answers exploitation attempts. Deception in Dynamic Web Application Honeypots: Case of Glastopf — Glastopf, a web-application honeypot that replies to attacks with the responses attackers expect. Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros et al. rate T1190 as highly feasible for infrastructure deception. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1190 Exploit Public-Facing Application as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1190 to its Lures activity.
T1671 Cloud Application Integration	Persistence	theoretical	moderate	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Microsoft Entra security operations for applications — Microsoft Entra audit logs record 'Consent to application' and credentials added to existing applications. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1671 Cloud Application Integration as an adversary behaviour. Direct only when the attacker consents to, or adds credentials to, an existing decoy application; registering a new app touches no decoy.

Evidence

Decoy Network Resource (D3-DNR) — MITRE D3FEND standard
Application Layer Cyber Deception without Developer Interaction — Kahlhofer, M.; Rass, S., ADnD 2024 (arXiv:2405.12852) 2024 peer-reviewed
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard