⚙️ Honey KMS Key

Decoy encryption keys for key enumeration detection.

What it is

An encryption key whose alias suggests it protects something valuable, but which encrypts nothing real and can be used by no real identity. Attackers target keys to decrypt data, or schedule their deletion to destroy it. Describing, using, disabling or scheduling deletion of the decoy key are logged events that name it.

Implementation requirements

• AWS: a KMS key with an alias that suggests it protects something valuable, and a key policy that lets no real principal use it. Azure: a Key Vault key. GCP: a Cloud KMS key
• Monitoring: AWS KMS operations on the key (DescribeKey, GetKeyPolicy, Decrypt, ScheduleKeyDeletion) appear in CloudTrail and name the key ARN. Check that the trail does not exclude KMS events, a per-trail option that drops all of them. Azure: KeyGet and cryptographic operations in the Key Vault AuditEvent log. GCP: Cloud KMS Data Access logs
• Strongest signals: a deletion or disable attempt (impact), or a key-policy change that grants someone use
• Listing keys and aliases returns every key and does not single out the decoy
• Safety: the key encrypts nothing real, so disabling or deleting it costs nothing. OPSEC: rotation setting and description like real keys
• Rollback: Schedule key deletion (nothing real is encrypted with it). Remove its alias.
• Upkeep: Confirm after trail changes that KMS events are not excluded. Quarterly proof-of-life DescribeKey.

Technologies

ATT&CK coverage 1

Evidence

• Decoy Object (D3-DO) — MITRE D3FEND standard
• Deploy and monitor Azure Key Vault honeytokens with Microsoft Sentinel — Microsoft industry
• MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard