🧠 Memory-Resident Honey-Token

Synthetic credentials injected into LSASS/Keychain.

→ Explore in ATT&CK matrix (8 mappings) Deployment detail

What it is

Decoy credentials placed in an endpoint's memory, for example in the Windows credential store, where credential-dumping tools will find them alongside real ones. Attackers dump credentials to move laterally. Dumping itself raises no alert here; the signal comes later, when the stolen decoy credential is used against a domain controller or service.

Implementation requirements

Windows: start a long-running process with decoy credentials using runas /netonly /user:DOMAIN\decoy-user <program>. Microsoft documents /netonly as using the credentials for remote access only; LSASS keeps them for that process, where a credential dump finds them next to real ones
Back the decoy with a real, disabled-or-powerless domain account (or a name that does not exist). Use of the stolen credential then shows up on the domain controllers: Kerberos 4768/4771 or NTLM 4776 naming that account. Microsoft Defender for Identity can also tag the account as a honeytoken and alert on its activity
macOS: add a decoy generic-password item to the login keychain (security add-generic-password) for a service you control. The signal is the credential being used against that service, not the keychain read
Re-inject after every reboot (a scheduled task or launch agent). Credentials in memory do not survive a restart
Safety: the account grants nothing, and its password is long and random, so cracking it yields nothing useful. OPSEC: the account name, groups and last-logon time should look like a real admin's
Rollback: Remove the scheduled task or launch agent that re-injects. Reboot or end the process, then disable or delete the decoy account.
Upkeep: Confirm after each reboot that injection ran. Monthly proof-of-life use of the credential.

Technologies

WindowsmacOS

ATT&CK coverage 8

Technique	Tactic	Status	Confidence	Tier
T1056 Input Capture	Collection	confirmed	strong	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (2 sources) BotSwindler: Tamper Resistant Injection of Believable Decoys in VM-Based Hosts for Crimeware Detection — Bait credentials injected through simulated user input were captured, and then used, by real credential-stealing malware. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1056 Input Capture as an adversary behaviour.
T1115 Clipboard Data	Collection	theoretical	weak	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1115 Clipboard Data as an adversary behaviour. No source shows clipboard honeytokens.
T1003 OS Credential Dumping	Credential Access	confirmed	strong	T4
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (2 sources) DCEPT — Domain Controller Enticing Password Tripwire — Caches fake credentials in endpoint memory and alerts on any logon attempt that uses them, which reveals credentials extracted from memory. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1003 to its Lures activity.
T1003.001 LSASS Memory	Credential Access	confirmed	strong	T4
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (4 sources) DCEPT — Domain Controller Enticing Password Tripwire — Caches fake credentials in endpoint memory; any logon attempt with them raises an alert. How Credential Harvesting Traps Help Detect Attackers Before Privilege Escalation — Honey credentials seeded into LSASS memory fire when an attacker who dumped them uses them. Detection of Breach Campaigns by using Distributed Deception — Places honey authentication values in processes such as lsass. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1003.001 LSASS Memory as an adversary behaviour.
T1003.002 Security Account Manager	Credential Access	theoretical	weak	T4
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1003.002 Security Account Manager as an adversary behaviour. The decoy is memory-resident; SAM is a registry hive.
T1003.003 NTDS	Credential Access	theoretical	weak	T4
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1003.003 NTDS as an adversary behaviour. The decoy is memory-resident; NTDS is the directory database.
T1003.004 LSA Secrets	Credential Access	theoretical	moderate	T4
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (2 sources) How Credential Harvesting Traps Help Detect Attackers Before Privilege Escalation — Honey credentials are seeded into LSASS memory, registry keys and local credential stores. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1003.004 LSA Secrets as an adversary behaviour. LSA secrets live in the registry; no source names them specifically.
T1134 Access Token Manipulation	Stealth	theoretical	moderate	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (2 sources) Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2014: any authentication activity by a honeytoken account raises an alert. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1134 Access Token Manipulation as an adversary behaviour.

Evidence

Decoy User Credential (D3-DUC) — MITRE D3FEND standard
How Credential Harvesting Traps Help Detect Attackers Before Privilege Escalation — Fidelis Security 2026 industry
DCEPT — Domain Controller Enticing Password Tripwire — Secureworks industry
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
Detection of Breach Campaigns by using Distributed Deception — Acalvio 2026 industry
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard