🗝️ Registry Honey Keys

Fake creds in well-known registry locations (VNC, WinSCP, PuTTY).

→ Explore in ATT&CK matrix (4 mappings) Deployment detail

What it is

Plant fake registry entries in well-known credential locations (e.g., HKLM\SOFTWARE\RealVNC, HKCU\Software\Martin Prikryl\WinSCP) containing honey credentials. Attacker enumeration tools (LaZagne, SessionGopher) automatically harvest these.

Implementation requirements

Registry write access on target endpoints
Fake entries matching known credential storage patterns (VNC, PuTTY, WinSCP, FileZilla)
EDR integration: Monitor registry read events on honey keys (Sysmon Event ID 13)
Honey credentials must route to DOAR-controlled infrastructure when used
Rollback: Delete the registry values from every host and revoke the credentials they hold.
Upkeep: Keep values in the format the imitated software currently uses. Monthly proof-of-life read from a test process.

Technologies

Windows

ATT&CK coverage 4

Technique	Tactic	Status	Confidence	Tier
T1552.002 Credentials in Registry	Credential Access	confirmed	strong	T4
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (3 sources) Detection of Breach Campaigns by using Distributed Deception — A production deception platform plants honey authentication values in the Windows registry. 4663(S) An attempt was made to access an object — Event 4663 records reads and writes on a file or registry key that carries an audit SACL. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1552.002 Credentials in Registry as an adversary behaviour.
T1012 Query Registry	Discovery	confirmed	strong	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (3 sources) Detection of Breach Campaigns by using Distributed Deception — A production deception platform plants honey authentication values in the Windows registry (e.g. IE IntelliForms storage), which alert when used. 4663(S) An attempt was made to access an object — Event 4663 records reads and writes on a file or registry key that carries an audit SACL. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1012 to its Lures activity.
T1547 Boot or Logon Autostart Execution	Persistence	theoretical	moderate	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (2 sources) 4663(S) An attempt was made to access an object — Event 4663 records reads and writes on a file or registry key that carries an audit SACL. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1547 Boot or Logon Autostart Execution as an adversary behaviour. Reading the honey run key is logged (T1012); the credential inside fires when used.
T1574 Hijack Execution Flow	Stealth	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) 4663(S) An attempt was made to access an object — Event 4663 records reads and writes on a file or registry key that carries an audit SACL. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1574 Hijack Execution Flow as an adversary behaviour. A deliberately 'vulnerable' decoy path; the attacker's write to it is logged.

Evidence

Detection of Breach Campaigns by using Distributed Deception — Acalvio industry
Detection of Breach Campaigns by using Distributed Deception — Acalvio 2026 industry
4663(S) An attempt was made to access an object — Microsoft industry
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard

Research basis: Acalvio "Endpoint Deception Breadcrumbs" (2020-2026). MITRE D3FEND technique D3-FDC (File Decoy).