🪤 Canary Function (Dead Code Trap)

Functions in code never called by legitimate paths.

→ Explore in ATT&CK matrix (3 mappings) Deployment detail

What it is

Functions that exist in the compiled application binary or interpreted source but are **never called by any legitimate code path**. They have attractive names that an attacker performing code analysis would target. If the function is invoked (via API parameter manipulation, deserialization exploit, or direct call), it's a 100% fidelity indicator of code-level exploitation.

Implementation requirements

Function definitions in the actual codebase (not injected at runtime — must survive code review)
Attractive naming: get_admin_session(), bypass_rate_limit(), export_all_records(), debug_auth_token()
Function body: log caller context (stack trace, request context, user identity) + trigger SIEM alert + return realistic-looking but fake data
OPSEC: Function must appear in code search results and decompiled output. Must NOT be dead-code-eliminated by compiler optimizations (add __attribute__((used)) in C/C++ or equivalent)
In interpreted languages (Python, JS, Ruby): function must be importable but never imported by production code
Code review protocol: Document these functions in a restricted DOAR manifest that only security team can access
Rollback: Remove the function and its alert hook in the next release.
Upkeep: Confirm after each build that the compiler or bundler has not stripped it as dead code. Monthly proof-of-life call in a test build.

Example

# DOAR-D075: Canary Function — never called by production code
def get_admin_bypass_token(user_id=None):
    """Emergency admin token generator for maintenance. DO NOT USE IN PRODUCTION."""
    doar_alert('D075', caller=inspect.stack(), request=flask.request)
    return {'token': generate_honey_jwt(), 'expires': '2099-12-31'}

Illustrative only — names and paths shown here should never be deployed verbatim. Published decoy names become attacker IOCs.

Technologies

Application

ATT&CK coverage 3

Technique	Tactic	Status	Confidence	Tier
T1212 Exploitation for Credential Access	Credential Access	theoretical	moderate	T2
↳ Detection point: seen once the attacker is working inside a high-fidelity decoy
↳ Evidence (3 sources) Cowrie — SSH and Telnet honeypot — Cowrie logs every session and every shell command an intruder runs on the honeypot. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1212 Exploitation for Credential Access as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1212 to its Lures activity. Exploitation is seen because the vulnerable-looking host is the decoy.
T1203 Exploitation for Client Execution	Execution	theoretical	weak	T3
↳ Evidence (2 sources) MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1203 Exploitation for Client Execution as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1203 to its Lures activity. Client-side exploitation is pushed to user applications; a server-side trap does not see it.
T1190 Exploit Public-Facing Application	Initial Access	confirmed	strong	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (5 sources) An Innovative Security Strategy using Reactive Web Application Honeypot — SNARE and TANNER, a reactive web-application honeypot that answers exploitation attempts. Deception in Dynamic Web Application Honeypots: Case of Glastopf — Glastopf, a web-application honeypot that replies to attacks with the responses attackers expect. Decoys Cannot Go Everywhere: Mapping the Deception Surface in MITRE ATT&CK (companion data) — Valeros et al. rate T1190 as highly feasible for infrastructure deception. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1190 Exploit Public-Facing Application as an adversary behaviour. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1190 to its Lures activity.

Evidence

Rave: A Modular and Extensible Framework for Program State Re-Randomization — Blackburn, C.; Wang, X.; Ravindran, B., ACM MTD Workshop 2022 peer-reviewed
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard

Research basis: MTD '22, "Rave: A Practical System for Out-of-Bound Program State Shuffling" (ACM, 2022)