📊 Honey Log Group

Decoy CloudWatch/Azure Monitor log groups.

→ Explore in ATT&CK matrix (5 mappings) Deployment detail

What it is

A log group named like a security log, with a little plausible content. Attackers delete or shorten logs to hide their tracks, often in bulk. Deleting the decoy log group or changing its retention are logged control-plane events, so log tampering touches the decoy along with real logs.

Implementation requirements

AWS: a CloudWatch Logs log group named like a security log (audit, GuardDuty export, VPC flow logs) with a little plausible content. Azure: a Log Analytics table or a diagnostic setting with an equivalent name
Monitoring, tampering: writes that name the decoy (DeleteLogGroup, PutRetentionPolicy, DeleteSubscriptionFilter, or deleting the Azure diagnostic setting) are logged control-plane events. Defence-evasion tooling that wipes logs touches the decoy along with real groups
Reads (GetLogEvents, FilterLogEvents) may not reach CloudTrail with default settings. Test before relying on them
Safety: the decoy holds no real log data. Protect real log groups with the same controls, so the decoy is not the only one an attacker can delete
Rollback: Delete the log group or diagnostic setting.
Upkeep: Write a little plausible content now and then, so it does not look abandoned. Quarterly proof-of-life retention change from a test principal.

Technologies

AWSAzure

ATT&CK coverage 5

Technique	Tactic	Status	Confidence	Tier
T1685 Disable or Modify Tools	Defense Impairment	theoretical	moderate
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Deception Engineering: exploring the use of Windows Service Canaries against ransomware — Prototype Windows service canaries: decoy services that ransomware stops before encrypting; several stopping together triggers the alert. Not tested against live ransomware. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1685 Disable or Modify Tools as an adversary behaviour. Logging management events — AWS CloudTrail User Guide — Disabling or deleting a decoy alarm or log group is a logged management event.
T1685.002 Disable or Modify Cloud Log	Defense Impairment	theoretical	moderate
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Logging management events — AWS CloudTrail User Guide — Control-plane reads and changes (create, attach, modify, delete) are management events, logged by default. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1685.002 Disable or Modify Cloud Log as an adversary behaviour.
T1526 Cloud Service Discovery	Discovery	theoretical	moderate	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — AWS Infrastructure token: decoy cloud resources that alert when an attacker interacts with them. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1526 to deception activities. Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — (D039) AWS Infrastructure token creates decoy SQS queues that alert when an attacker interacts with them. Moderate: discovering that a service exists does not necessarily touch a decoy resource in it.
T1654 Log Enumeration	Discovery	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros et al. rate T1654 as highly feasible for infrastructure deception. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1654 Log Enumeration as an adversary behaviour. Reading a decoy log is logged only where read access is audited.
T1070 Indicator Removal	Stealth	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Logging management events — AWS CloudTrail User Guide — Control-plane reads and changes are management events, logged by default. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1070 Indicator Removal as an adversary behaviour. Deleting a decoy log group or alarm is a logged management event.
↳ Good fit (tampering with decoy logs is a clean signal); technique evidence is industry-only.

Evidence

Decoy Object (D3-DO) — MITRE D3FEND standard
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard