🎣 Forward-Deployed Lure

Fake OSINT profiles and poisoned public repos.

→ Explore in ATT&CK matrix (16 mappings) Deployment detail

What it is

Lures placed outside the organisation, such as a public repository or a decoy staff identity, containing credentials or details that lead into infrastructure you control. Attackers research targets publicly before acting. A callback from the credential, or contact with the decoy identity, shows that someone is acting on the lure; automated scanners trip these too.

Implementation requirements

Public repository lure: a plausible repository or gist that appears to belong to your organisation and contains a credential pointing into infrastructure you control, such as a login for an internet-facing decoy (D011, D027) or a canarytoken
Expect secret scanners to find it first. AWS can quarantine exposed keys, and researchers' scanners will trip tokens. Triage those hits as noise, and prefer credentials for your own decoy service over cloud keys
Persona lure: a decoy employee identity whose email address exists only for the lure. Any mail, sign-in attempt or phishing aimed at it is the signal (mail gateway logs, the decoy account's sign-in logs)
Legal: several social networks prohibit fake profiles in their terms. Get legal sign-off before creating personas, and prefer lures on infrastructure you control
Safety: never include real code, internal hostnames, employee names or architecture in a public lure
Monitoring: callbacks from the token or decoy service. Record the time of publication, so you can tell automated scanning (minutes) from targeted use
Rollback: Delete the public repository or persona. Revoke every credential it exposed. Public copies can survive in forks and archives, so treat every credential it exposed as burned.
Upkeep: Expect scanner noise; review hits weekly. Keep a record of what was published and where.

Technologies

Cloud

ATT&CK coverage 16

Technique	Tactic	Status	Confidence	Tier
T1566 Phishing	Initial Access	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros et al. rate T1566 as highly feasible for infrastructure deception. Message trace in the new EAC in Exchange Online — Exchange Online message trace records every message received and delivered to a given recipient. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1566 Phishing as an adversary behaviour. Backed by D003/D055; D051 is re-homed to the ATT&CK v20 AI techniques in step 5.
T1566.001 Spearphishing Attachment	Initial Access	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Message trace in the new EAC in Exchange Online — Exchange Online message trace records every message delivered to a given recipient. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1566.001 Spearphishing Attachment as an adversary behaviour.
T1566.002 Spearphishing Link	Initial Access	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Message trace in the new EAC in Exchange Online — Exchange Online message trace records every message delivered to a given recipient. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1566.002 Spearphishing Link as an adversary behaviour.
T1589 Gather Victim Identity Information	Reconnaissance	theoretical	moderate	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (3 sources) Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) — Alert 2014: any authentication activity by a honeytoken account raises an alert. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1589 Gather Victim Identity Information as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1589 to its Lures activity. Collecting fake identities is passive; they fire when the attacker uses them.
↳ D3-DP exact match; low feasibility per the framework's own gap analysis.
T1590 Gather Victim Network Information	Reconnaissance	theoretical	moderate	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (3 sources) Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — DNS token: anyone resolving the decoy hostname triggers an alert. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1590 Gather Victim Network Information as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1590 to its Lures activity.
↳ Decoy Persona (D3-DP) is an exact match, but recon-stage deception has low real-world feasibility.
T1591 Gather Victim Org Information	Reconnaissance	theoretical	weak	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (2 sources) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1591 Gather Victim Org Information as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1591 to its Lures activity. Organisation research is passive and produces no signal.
↳ Attacker can cross-validate org info elsewhere.
T1592 Gather Victim Host Information	Reconnaissance	theoretical	weak	T1
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (2 sources) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1592 Gather Victim Host Information as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1592 to its Lures activity. Host information collection is passive.
T1592.001 Hardware	Reconnaissance	theoretical	weak	T1
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1592.001 Hardware as an adversary behaviour. Passive collection.
T1592.002 Software	Reconnaissance	theoretical	weak	T1
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1592.002 Software as an adversary behaviour. Passive collection.
T1593 Search Open Websites/Domains	Reconnaissance	theoretical	weak	T1
↳ Evidence (2 sources) Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros et al. rate T1593 as feasible (medium) for infrastructure deception. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1593 Search Open Websites/Domains as an adversary behaviour. Searching open websites never touches defender infrastructure.
T1594 Search Victim-Owned Websites	Reconnaissance	theoretical	moderate	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (4 sources) Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros et al. rate T1594 as feasible (medium) for infrastructure deception. Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — DNS token: anyone resolving the decoy hostname triggers an alert. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1594 Search Victim-Owned Websites as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1594 to its Lures activity.
T1595 Active Scanning	Reconnaissance	confirmed	strong	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) A Virtual Honeypot Framework — Honeyd simulates hosts on unallocated addresses and deceives network scanning and fingerprinting tools. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1595 to its Lures activity.
T1595.001 Scanning IP Blocks	Reconnaissance	confirmed	strong	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) A Virtual Honeypot Framework — Honeyd simulates hosts on unallocated addresses and deceives scanning tools. The UCSD Network Telescope — The UCSD Network Telescope observes scans directed at a large routed but unused address block. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1595.001 Scanning IP Blocks as an adversary behaviour.
T1595.002 Vulnerability Scanning	Reconnaissance	confirmed	strong	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) A Virtual Honeypot Framework — Honeyd deceives network scanning and fingerprinting tools. An Innovative Security Strategy using Reactive Web Application Honeypot — A reactive web-application honeypot evaluates the attack requests sent to it. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1595.002 Vulnerability Scanning as an adversary behaviour.
T1597 Search Closed Sources	Reconnaissance	theoretical	weak	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (1 source) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1597 Search Closed Sources as an adversary behaviour. Closed-source research never touches defender infrastructure.
↳ Seeding threat-intel feeds is very advanced forward-deployed deception; unproven.
T1598 Phishing for Information	Reconnaissance	theoretical	moderate	T1
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros et al. rate T1598 as highly feasible for infrastructure deception. Message trace in the new EAC in Exchange Online — Exchange Online message trace records every message received and delivered to a given recipient. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1598 Phishing for Information as an adversary behaviour.

Evidence

Decoy Persona (D3-DP) — MITRE D3FEND standard
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros, V.; Catania, C.; Lisý, V.; Griffioen, H., Stratosphere Laboratory, Czech Technical University in Prague 2026 preprint
Message trace in the new EAC in Exchange Online — Microsoft industry
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard