📊 Honey Alarm/Alert

Decoy monitoring alarms — disabling them = confirmed malicious.

→ Explore in ATT&CK matrix (5 mappings) Deployment detail

What it is

A monitoring alarm named like a security control whose notification goes to a decoy target you watch. Attackers silence alarms before acting. Disabling, deleting or changing the decoy alarm are logged writes, a strong defence-evasion signal because nothing legitimate touches it.

Implementation requirements

AWS: a CloudWatch alarm named like a security control (root login, CloudTrail stopped) whose action notifies a decoy SNS topic you also watch. Azure: an alert rule. GCP: an alerting policy
Monitoring: attempts to disable or delete it (DisableAlarmActions, DeleteAlarms, PutMetricAlarm changing it; Azure alert-rule deletes in the Activity Log; GCP alert-policy changes in Admin Activity logs) are logged writes. Nothing legitimate changes a decoy alarm, so a change is a strong defence-evasion signal
Keep real alarms protected too: attackers who disable alarms usually disable them in bulk, and the decoy catches the bulk sweep
Safety: the decoy's metric and action affect nothing real. OPSEC: naming, thresholds and history like real alarms
Rollback: Delete the alarm and its decoy notification target.
Upkeep: Quarterly proof-of-life disable-and-restore from a test principal.

Technologies

AWSAzureGCP

ATT&CK coverage 5

Technique	Tactic	Status	Confidence	Tier
T1685 Disable or Modify Tools	Defense Impairment	theoretical	moderate
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Deception Engineering: exploring the use of Windows Service Canaries against ransomware — Prototype Windows service canaries: decoy services that ransomware stops before encrypting; several stopping together triggers the alert. Not tested against live ransomware. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1685 Disable or Modify Tools as an adversary behaviour. Logging management events — AWS CloudTrail User Guide — Disabling or deleting a decoy alarm or log group is a logged management event.
T1685.002 Disable or Modify Cloud Log	Defense Impairment	theoretical	moderate
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Logging management events — AWS CloudTrail User Guide — Control-plane reads and changes (create, attach, modify, delete) are management events, logged by default. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1685.002 Disable or Modify Cloud Log as an adversary behaviour.
T1489 Service Stop	Impact	theoretical	moderate	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Deception Engineering: exploring the use of Windows Service Canaries against ransomware — Prototype Windows service canaries: decoy services that ransomware stops before encrypting; several stopping together triggers the alert. Not tested against live ransomware. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1489 Service Stop as an adversary behaviour. Moderate: the service canary is a published prototype, not yet tested against live ransomware.
T1529 System Shutdown/Reboot	Impact	theoretical	moderate	T2
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (3 sources) Cowrie — SSH and Telnet honeypot — Cowrie logs every session and shell command an intruder runs on the honeypot. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1529 System Shutdown/Reboot as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1529 to its Lures activity.
↳ Detects shutdown of a decoy, not of real systems.
T1070 Indicator Removal	Stealth	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Logging management events — AWS CloudTrail User Guide — Control-plane reads and changes are management events, logged by default. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1070 Indicator Removal as an adversary behaviour. Deleting a decoy log group or alarm is a logged management event.
↳ Good fit (tampering with decoy logs is a clean signal); technique evidence is industry-only.

Evidence

Decoy Object (D3-DO) — MITRE D3FEND standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard