📄 Honey SharePoint/Drive Site

Fake M365/GWorkspace sites with canary documents.

→ Explore in ATT&CK matrix (3 mappings) Deployment detail

What it is

Create fake SharePoint sites / Google Drive folders with names like Board Meeting Minutes, M&A Due Diligence containing canary documents. Any access by non-admin accounts triggers SOC alert.

Implementation requirements

M365 / Google Workspace admin access
Canary documents with embedded tracking (Canarytokens, custom macros)
Restrict legitimate access to a single monitoring service account
Unified Audit Log (M365) or Google Workspace Activity API monitoring
Rollback: Delete the site or folder, then empty the recycle bin it lands in.
Upkeep: Refresh document dates, and check after tenant changes that audit logging still covers it. Monthly proof-of-life open.

Technologies

Google WorkspaceM365

ATT&CK coverage 3

Technique	Tactic	Status	Confidence	Tier
T1114 Email Collection	Collection	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Use MailItemsAccessed to investigate compromised accounts — MailItemsAccessed records every access to mail items (sync and bind) across all mail protocols; on by default for E3/E5. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1114 Email Collection as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1114 to its Lures activity. Reading a honey mailbox is recorded by MailItemsAccessed; no study shows honey mailboxes specifically.
T1213 Data from Information Repositories	Collection	confirmed	strong	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (5 sources) GitGuardian Honeytoken — core concepts — Production honeytokens placed in code repositories, CI/CD, Docker images, Jira, Confluence and Slack; any use of one raises an alert. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1213 to its Lures activity. Detecting RAG Extraction Attack via Dual-Path Runtime Integrity Game (CanaryRAG) — (D071) CanaryRAG embeds canary tokens in retrieved chunks to detect knowledge-base extraction through the model. Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection — (D051) LLM-integrated applications follow instructions hidden in content they retrieve. LLM Agent Honeypot: Monitoring AI Hacking Agents in the Wild — (D051) Prompt injections embedded in honeypot responses identified AI hacking agents in the wild (8 potential agents over three months).
T1530 Data from Cloud Storage	Collection	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (4 sources) Using Honeybuckets to Characterize Cloud Storage Scanning in the Wild — Hundreds of S3 honeybuckets: attackers in the wild downloaded, uploaded and deleted files, and acted on documents they read. 2023 Honeypotting in the Cloud Report — Keys planted in S3 buckets were accessed and used within 8 hours. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1530 to Lures: touching a tripwire resource is easily detectable. Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) — (D039) AWS Infrastructure token creates decoy SQS queues that alert when an attacker interacts with them.

Evidence

Mitigating Data Exfiltration in Storage-as-a-Service Clouds — Wilson, D.; Avery, J., arXiv 2016 peer-reviewed
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard

Research basis: "Mitigating Data Exfiltration in SaaS Clouds" — arXiv, 2016. Industry practice of "HoneyTenants."