🔌 Honey Webhook

Canary webhook URLs planted in configs.

→ Explore in ATT&CK matrix (5 mappings) Deployment detail

What it is

A webhook URL that points to an endpoint you control, planted in configs and scripts where real webhooks live. Attackers reuse webhooks to send data out or to test what they have found. Any request to the endpoint is the signal, and it carries the caller's address and request details.

Implementation requirements

Create a webhook URL on a host you control (or a Canarytokens HTTP token) and plant it where real webhook URLs live: CI/CD configs, chat-ops scripts, alerting configs
Use your own domain or a token service rather than imitating a third-party webhook format. Third-party formats are matched by secret scanners, which produce noisy hits
Monitoring: the endpoint logs every request with source IP, user agent and body. Nothing legitimate posts to it
Safety: the endpoint accepts and stores, and never executes or forwards. OPSEC: a path and parameters shaped like the integration it imitates
Rollback: Remove the planted URLs. Shut down the endpoint or deactivate the token.
Upkeep: Monthly proof-of-life POST.

Technologies

Application

ATT&CK coverage 5

Technique	Tactic	Status	Confidence	Tier
T1102 Web Service	Command & Control	theoretical	weak	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1102 Web Service as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1102 to its Lures activity. No evidence attackers use a found webhook as C2.
↳ Honey webhook as a C2 detector — industry-plausible only.
T1528 Steal Application Access Token	Credential Access	theoretical	moderate	T4
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (3 sources) AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1528 Steal Application Access Token as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1528 to its Lures activity. A stolen honey token fires when it is used, not when it is stolen.
T1567 Exfiltration Over Web Service	Exfiltration	theoretical	weak	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1567 Exfiltration Over Web Service as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1567 to its Lures activity. No evidence attackers exfiltrate to a webhook found in code; they use services they control.
T1567.004 Exfiltration Over Webhook	Exfiltration	theoretical	weak	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1567.004 Exfiltration Over Webhook as an adversary behaviour. No evidence attackers exfiltrate to a webhook found in code.
T1671 Cloud Application Integration	Persistence	theoretical	moderate	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Microsoft Entra security operations for applications — Microsoft Entra audit logs record 'Consent to application' and credentials added to existing applications. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1671 Cloud Application Integration as an adversary behaviour. Direct only when the attacker consents to, or adds credentials to, an existing decoy application; registering a new app touches no decoy.

Evidence

Decoy Object (D3-DO) — MITRE D3FEND standard
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard