🗄️ Honey SQS/SNS Queue

Decoy message queues.

→ Explore in ATT&CK matrix (2 mappings) Deployment detail

What it is

A message queue or topic named like a real integration, such as payments or audit export, holding a few fake messages. Attackers read queues to find data in transit and credentials in messages. Receiving or publishing on the decoy is recorded by data-event logging, and a honeytoken in a message alerts when used.

Implementation requirements

AWS: an SQS queue or SNS topic named like a real integration (payments, audit export). Azure Service Bus and GCP Pub/Sub are the equivalents
Monitoring: SQS API activity on messages and SNS Publish are CloudTrail data events; enable them for the decoy's ARN. Service Bus and Pub/Sub: their diagnostic and Data Access logs
Seed a few fake messages so a receive returns something plausible, and include a honeytoken (D006) in one of them
Safety: no real producer or consumer is wired to it. OPSEC: retention, encryption and tags like real queues
Rollback: Delete the queue or topic. Revoke honeytokens in its messages.
Upkeep: Re-seed messages before retention expires them. Monthly proof-of-life receive.

Technologies

AWSAzureGCP

ATT&CK coverage 2

Technique	Tactic	Status	Confidence	Tier
T1530 Data from Cloud Storage	Collection	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (4 sources) Using Honeybuckets to Characterize Cloud Storage Scanning in the Wild — Hundreds of S3 honeybuckets: attackers in the wild downloaded, uploaded and deleted files, and acted on documents they read. 2023 Honeypotting in the Cloud Report — Keys planted in S3 buckets were accessed and used within 8 hours. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1530 to Lures: touching a tripwire resource is easily detectable. Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — (D039) AWS Infrastructure token creates decoy SQS queues that alert when an attacker interacts with them.
T1526 Cloud Service Discovery	Discovery	theoretical	moderate	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — AWS Infrastructure token: decoy cloud resources that alert when an attacker interacts with them. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1526 to deception activities. Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — (D039) AWS Infrastructure token creates decoy SQS queues that alert when an attacker interacts with them. Moderate: discovering that a service exists does not necessarily touch a decoy resource in it.

Evidence

Decoy Object (D3-DO) — MITRE D3FEND standard
Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — Thinkst Applied Research industry
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard