⚙️ Breadcrumb Chain

Multi-hop deception path: breadcrumb → pivot → crown jewel.

→ Explore in ATT&CK matrix (2 mappings) Deployment detail

What it is

A chain of decoys in which each hop leads to the next: a breadcrumb points to a decoy host, which holds a credential for a decoy crown jewel. Attackers follow trails like these, because that is how they move through real environments. Every hop alerts on its own, so the chain shows how far the attacker got and in what order.

Implementation requirements

Chain decoys so that each hop leads to the next: a breadcrumb (a script, a shell history line, a saved connection) points to a pivot decoy (D011), which holds a credential (D006, D043) for a crown-jewel decoy (D019, D015)
Every hop alerts on its own, so the chain shows how far the intruder got and in which order
Give each breadcrumb its own unique credential, so the alert identifies which host leaked it
Safety: no hop leads to a real system, and every credential grants access to decoys only. OPSEC: breadcrumbs placed where real ones occur, and decoy hops that match their neighbours (see each technique's OPSEC note)
Rollback: Remove hops from the crown jewel backwards, so no breadcrumb points to something deleted. Revoke every per-hop credential.
Upkeep: Walk the whole chain quarterly; one broken hop strands the rest. Proof-of-life on each hop.

Technologies

Cloud

ATT&CK coverage 2

Technique	Tactic	Status	Confidence	Tier
T1199 Trusted Relationship	Initial Access	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Logging management events — AWS CloudTrail User Guide — Control-plane changes (create, modify, delete) are management events, logged by default. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1199 Trusted Relationship as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1199 to its Lures activity. No study or product shows honey cross-account roles; the AssumeRole call on the decoy role is logged.
T1072 Software Deployment Tools	Lateral Movement	theoretical	moderate	T3
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (4 sources) GitGuardian Honeytoken — core concepts — Production honeytokens placed in CI/CD systems and repositories alert when used. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1072 Software Deployment Tools as an adversary behaviour. Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros et al. rate T1072 as feasible (medium) for infrastructure deception. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1072 to its Lures activity.

Evidence

Decoy Object (D3-DO) — MITRE D3FEND standard
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard
How Credential Harvesting Traps Help Detect Attackers Before Privilege Escalation — Fidelis Security 2026 industry
Detection of Breach Campaigns by using Distributed Deception — Acalvio 2026 industry