🏗️ Honey Event Rule

Decoy EventBridge/Event Grid rules.

→ Explore in ATT&CK matrix (1 mappings) Deployment detail

What it is

An event rule named like security automation, such as a rule that triggers remediation, whose target is a decoy you watch. Attackers disable automated response before acting. Disabling, deleting or editing the decoy rule are logged writes, and nothing legitimate ever changes it.

Implementation requirements

AWS: an EventBridge rule named like security automation (a GuardDuty-to-remediation rule) whose target is a decoy function or topic you watch. Azure: an Event Grid subscription. GCP: an Eventarc trigger
Monitoring: DisableRule, DeleteRule, RemoveTargets or PutRule changing the decoy are logged writes. Attackers disabling automated response tend to sweep all rules, and the decoy catches the sweep
Safety: the target does nothing real. OPSEC: event pattern and naming consistent with real rules
Rollback: Delete the rule and its decoy target.
Upkeep: Quarterly proof-of-life disable-and-restore from a test principal.

Technologies

AWSAzureGCP

ATT&CK coverage 1

Technique	Tactic	Status	Confidence	Tier
T1546 Event Triggered Execution	Persistence	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Logging management events — AWS CloudTrail User Guide — Control-plane changes (create, modify, delete) are management events, logged by default. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1546 Event Triggered Execution as an adversary behaviour. Direct only when the attacker modifies an existing decoy rule; creating a new rule touches no decoy.

Evidence

Decoy Object (D3-DO) — MITRE D3FEND standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard