📦 Honey Backup/Snapshot

Decoy EBS/RDS snapshots for data recovery attack detection.

→ Explore in ATT&CK matrix (4 mappings) Deployment detail

What it is

Decoy backups or snapshots named like production backups and holding synthetic data. Ransomware operators delete backups before encrypting, and data thieves restore or share them. Deleting, sharing or restoring a decoy backup are logged writes that give early warning of the sweep.

Implementation requirements

AWS: decoy recovery points (AWS Backup) or RDS snapshots named like production backups, holding synthetic data. Azure: Recovery Services backup items. GCP: Backup and DR backups or Cloud SQL backups
Monitoring: logged writes naming the decoy, such as deletion (DeleteRecoveryPoint, DeleteDBSnapshot), sharing to another account (ModifyDBSnapshotAttribute), or a restore (StartRestoreJob, RestoreDBInstanceFromDBSnapshot)
Ransomware operators delete backups in bulk before encrypting, so the decoy catches the sweep early. Treat any delete of a decoy backup as a response trigger
Safety: synthetic data only, marked internally. OPSEC: retention and schedule like real backups
Rollback: Delete the decoy recovery points or snapshots. Remove sharing permissions first, if any were set.
Upkeep: Create new decoy backups on the real backup schedule. Quarterly proof-of-life delete attempt from a test principal.

Technologies

AWSAzureGCP

ATT&CK coverage 4

Technique	Tactic	Status	Confidence	Tier
T1578 Modify Cloud Compute Infrastructure	Defense Impairment	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) MITRE ATT&CK Enterprise v20.0 — Adversaries create, delete or modify instances and snapshots, which can also remove evidence of their presence. Logging management events — AWS CloudTrail User Guide — These are write management events, logged by default. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1578 to its Lures activity. Moderate: behaviour and log signal are documented; no study or product shows honey instances or snapshots specifically.
T1578.001 Create Snapshot	Defense Impairment	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Logging management events — AWS CloudTrail User Guide — Control-plane reads and changes (create, attach, modify, delete) are management events, logged by default. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1578.001 Create Snapshot as an adversary behaviour.
T1485 Data Destruction	Impact	theoretical	moderate	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (4 sources) Logging management events — AWS CloudTrail User Guide — Control-plane changes (create, modify, delete) are management events, logged by default. Logging data events — AWS CloudTrail User Guide — S3 object operations and Lambda Invoke are data events, logged only once data-event logging is enabled. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1485 Data Destruction as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1485 to its Lures activity. Deleting a decoy snapshot or database is a management event; deleting objects in a decoy bucket needs data events enabled.
T1490 Inhibit System Recovery	Impact	theoretical	moderate	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) MITRE ATT&CK Enterprise v20.0 — In cloud environments adversaries delete snapshots, database backups and machine images. Logging management events — AWS CloudTrail User Guide — Delete operations are write management events, logged by trails by default, so deleting a decoy snapshot leaves a record naming it. Moderate: behaviour and log signal are documented; no study or product shows honey snapshots specifically.

Evidence

Decoy Object (D3-DO) — MITRE D3FEND standard
Logging management events — AWS CloudTrail User Guide — Amazon Web Services industry
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard