⚙️ Honey Policy Document

Decoy IAM/resource policies.

→ Explore in ATT&CK matrix (9 mappings) Deployment detail

What it is

A customer-managed policy with an attractive name, such as break-glass or admin, attached to nothing. Attackers read policies to plan privilege escalation and attach powerful ones to identities they control. Targeted reads of the decoy policy are logged, and any attempt to attach it is a strong signal.

Implementation requirements

AWS: a customer-managed IAM policy with an attractive name (break-glass, admin) attached to nothing. Azure and GCP: a custom role definition (see D001)
Monitoring: targeted reads (iam:GetPolicy, iam:GetPolicyVersion on the decoy ARN) are read-only management events. Trails record them by default; EventBridge rules need the ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS state to match them
Strongest signal: any attempt to attach it (AttachRolePolicy, AttachUserPolicy, AttachGroupPolicy naming the decoy ARN)
Known limit: bulk enumeration (GetAccountAuthorizationDetails) returns every policy in one call and does not single out the decoy
Safety: never attach it to a real principal. If it must appear in use, attach it to a decoy principal with no credentials. OPSEC: version history and description like real policies
Rollback: Delete the policy, after confirming it is attached to nothing.
Upkeep: Add a new version occasionally, so it looks maintained. Quarterly proof-of-life GetPolicyVersion.

Technologies

AWSAzureGCP

ATT&CK coverage 9

Technique	Tactic	Status	Confidence	Tier
T1685 Disable or Modify Tools	Defense Impairment	theoretical	moderate
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Deception Engineering: exploring the use of Windows Service Canaries against ransomware — Prototype Windows service canaries: decoy services that ransomware stops before encrypting; several stopping together triggers the alert. Not tested against live ransomware. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1685 Disable or Modify Tools as an adversary behaviour. Logging management events — AWS CloudTrail User Guide — Disabling or deleting a decoy alarm or log group is a logged management event.
T1201 Password Policy Discovery	Discovery	theoretical	weak	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1201 Password Policy Discovery as an adversary behaviour. Password policy is domain-wide; reading a decoy policy document is T1083/T1039, not policy discovery.
T1538 Cloud Service Dashboard	Discovery	theoretical	moderate	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Logging management events — AWS CloudTrail User Guide — Control-plane reads and changes are management events, logged by default. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1538 Cloud Service Dashboard as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1538 to its Lures activity.
T1651 Cloud Administration Command	Execution	theoretical	moderate	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros et al. rate T1651 as feasible (medium) for infrastructure deception. Logging management events — AWS CloudTrail User Guide — Control-plane reads and changes are management events, logged by default. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1651 Cloud Administration Command as an adversary behaviour.
T1657 Financial Theft	Impact	theoretical	weak	T4
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1657 Financial Theft as an adversary behaviour. Financial theft is an outcome; access to decoy billing data is collection.
T1098 Account Manipulation	Persistence	confirmed	strong	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alerts 2427 (attributes modified) and 2428 (group membership changed) fire on any change to a honeytoken user; Microsoft maps both to T1098. Logging management events — AWS CloudTrail User Guide — IAM AttachRolePolicy is a logged management event, so changes to a decoy IAM role are recorded (cloud decoys: moderate). MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1098 to its Lures activity.
T1098.003 Additional Cloud Roles	Persistence	theoretical	moderate	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Logging management events — AWS CloudTrail User Guide — IAM AttachRolePolicy is a logged management event. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1098.003 Additional Cloud Roles as an adversary behaviour.
T1098 Account Manipulation	Privilege Escalation	confirmed	strong	T3
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alerts 2427 (attributes modified) and 2428 (group membership changed) fire on any change to a honeytoken user; Microsoft maps both to T1098. Logging management events — AWS CloudTrail User Guide — IAM AttachRolePolicy is a logged management event, so changes to a decoy IAM role are recorded (cloud decoys: moderate). MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1098 to its Lures activity.
T1484 Domain or Tenant Policy Modification	Privilege Escalation	theoretical	moderate	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Logging management events — AWS CloudTrail User Guide — Control-plane changes (create, modify, delete) are management events, logged by default. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1484 Domain or Tenant Policy Modification as an adversary behaviour.

Evidence

Decoy Object (D3-DO) — MITRE D3FEND standard
Decoy Public Release (D3-DPR) — MITRE D3FEND standard
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard
Baiting Inside Attackers Using Decoy Documents — Bowen, B.; Hershkop, S.; Keromytis, A.; Stolfo, S., SecureComm 2009 peer-reviewed