⚙️ Honey Tag/Label

Canary tags on real resources.

→ Explore in ATT&CK matrix (2 mappings) Deployment detail

What it is

A tag or label on a real or decoy resource that points to something attractive, such as a decoy secret or backup. Tags raise no event when they are read, so the signal comes from the decoy the tag points to, or from someone changing the tag itself.

Implementation requirements

Add tags or labels to real or decoy resources that point to something attractive: a tag naming a decoy secret, a decoy backup vault or a decoy administrator
Tags raise no event when read. The signal comes from the decoy the tag points to (D020, D042), or from tampering: TagResource or UntagResource changing the canary tag key, which is a logged write
Safety: never put a real secret or real hostname in a tag. Tags are visible to anyone who can list the resource
Rollback: Remove the canary tag key from every resource carrying it.
Upkeep: Re-check that the decoys the tags point to still exist.

Technologies

Cloud

ATT&CK coverage 2

Technique	Tactic	Status	Confidence	Tier
T1538 Cloud Service Dashboard	Discovery	theoretical	moderate	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Logging management events — AWS CloudTrail User Guide — Control-plane reads and changes are management events, logged by default. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1538 Cloud Service Dashboard as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1538 to its Lures activity.
T1535 Unused/Unsupported Cloud Regions	Stealth	theoretical	weak	T4
↳ Evidence (2 sources) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1535 Unused/Unsupported Cloud Regions as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1535 to its Lures activity. Attackers can operate in unused regions without touching an existing decoy.

Evidence

Decoy Object (D3-DO) — MITRE D3FEND standard
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard