Methodology
How coverage claims in this framework are graded, what evidence stands behind them, and what was removed when they were audited.
Two scales, deliberately separate
Two different things get graded here, and conflating them is how frameworks end up overstating coverage.
Scale A — technique evidence
How well-evidenced is a deception technique itself? Strong means an exact MITRE D3FEND match or a peer-reviewed source directly on point. Moderate means a D3FEND category plus credible industry work, with no dedicated study. Weak means only generic or extrapolated backing.
Scale B — mapping verdict
Does this pairing of a decoy with an ATT&CK technique hold up? Each mapping row is graded on the published evidence attached to it:
| Grade | What it takes |
|---|---|
| strong | The decoy has caught this behaviour from real attackers, or a production product or tool implements the decoy for it, or practitioners document using it. |
| moderate | The attacker behaviour is documented and the log signal the decoy relies on is documented, or a study shows the approach is feasible. |
| weak | Reasoning only. Kept, labelled, and shown, but never presented as more than that. |
A row's status follows its grade: confirmed if and only if it is strong, otherwise theoretical. A pairing found to be wrong is removed and recorded under Corrections.
The evidence behind each mapping
Every one of the 225 mapped rows carries its own evidence: one or more linked sources, each with a note on what it shows for that specific pairing. Every source was opened and read before it was attached; search-engine summaries were not accepted. The Evidence page lists each source with the date it was checked and the mappings it supports. Sources that turned out not to say what they were cited for were removed, not reworded.
Where the decoy fires
A detail shown on each mapping, not used in any count. It tells a defender what kind of signal to expect.
| Label | Meaning | Rows |
|---|---|---|
| Direct | The attack step itself touches the decoy. | 150 |
| Inside a decoy | Seen once the attacker is working inside a high-fidelity decoy. | 23 |
| Later step | The decoy fires at a later step of the attack. | 42 |
10 weak mapped rows carry no label because their own evidence says no decoy observes the step (for example, passive research on public websites). They are kept as labelled weak claims and are included in the all-mapped figure.
Reading the coverage numbers
Counted against MITRE ATT&CK Enterprise v20.0 (227 parent techniques). Every id in the matrix is reconciled against that release at build time, so revoked or mis-classified techniques fail the build rather than drifting silently into the coverage figures. The three figures are separate claims and are always shown together.
| Basis | Techniques | % | Claim |
|---|---|---|---|
| All mapped | 138 | 60.8% | The headline figure, counted the way comparable work counts coverage. Includes weak mappings, each labelled. |
| Strong + moderate | 100 | 44.1% | Mappings backed by documented evidence. |
| Strong | 42 | 18.5% | Seen against real attackers, implemented in production tools, or in documented practitioner use. |
The first audit
Before the evidence pass, the mappings that existed only in the framework's projected matrix were audited one by one:
Those grades have since been superseded by the evidence-based grades above; the figures are kept as the record of that audit.
Corrections applied
These mappings were removed. They are listed rather than quietly deleted, because the removals are part of the record.
Category error: D058 is Windows-Registry-specific; T1647 is macOS plist modification. The mechanism described is a distinct technique that does not yet exist in the registry.
Recommendation — Create a new DOAR technique (Honey Plist / LaunchAgent) rather than reusing D058.
A DNS sinkhole receives traffic regardless of encryption; it does not detect encryption as a distinct behaviour.
Recommendation — Leave unmapped.
A DNS sinkhole receives traffic regardless of its encoding; it does not detect encoding as a distinct behaviour.
Recommendation — Leave unmapped. Counted as coverage padding in the v2 matrix.
Platform contradiction (T1647 class): D043 is a memory-resident honey-token in LSASS/Keychain (Windows/macOS). T1003.008 is Linux shadow-file dumping. An LSASS-resident token cannot detect it.
Recommendation — Needs a Linux credential-store decoy; do not reuse D043.
D047 is a Responder/LLMNR broadcast poisoning lure with no visibility into registry modification. The row's own description describes adversary-in-the-middle, not registry activity.
Recommendation — Reassign to a registry decoy (D058) only if a registry-modification claim can be evidenced; otherwise leave unmapped.
Same defect as the persistence row: D047 cannot observe registry modification.
Recommendation — As above.
Obfuscation is encoding inside the attacker's own C2 traffic; a data maze never sees it.
Recommendation — None — the claim has no mechanism. Recorded so it is not re-added.
Enumerating windows on a host never touches a dashboard or API route.
Recommendation — None — the claim has no mechanism. Recorded so it is not re-added.
T1016 is host-local network configuration (no IaaS platform in ATT&CK). Cloud VPC/subnet enumeration is T1580, where D022 already sits and D023 is added.
Recommendation — Map cloud network decoys to T1580 Cloud Infrastructure Discovery (done in this change).
No mechanism: an attacker naming malware after a honey process produces no decoy event.
Recommendation — None — the claim has no mechanism. Recorded so it is not re-added.
Native API calls are in-process on the attacker's host; an application dead-code trap or code-path monitor is unrelated.
Recommendation — None — the claim has no mechanism. Recorded so it is not re-added.
MFA interception targets factors issued to real users; no decoy sits in that path.
Recommendation — None — the claim has no mechanism. Recorded so it is not re-added.
Screenshotting fake data produces no event.
Recommendation — None — the claim has no mechanism. Recorded so it is not re-added.
Module loading is in-process on a host the attacker controls; no decoy is touched.
Recommendation — None — the claim has no mechanism. Recorded so it is not re-added.
The description (Office templates) does not match D070 (honey SharePoint site), and T1137 is persistence on a host the attacker controls.
Recommendation — None — the claim has no mechanism. Recorded so it is not re-added.
Installing an extension on a host the attacker controls never touches a honey browser profile.
Recommendation — None — the claim has no mechanism. Recorded so it is not re-added.
T1187 is the attacker coercing authentication. D047 catches LLMNR/NBT-NS poisoning, which is T1557.001, where it is already mapped.
Recommendation — Keep D047 on T1557.001 LLMNR/NBT-NS Poisoning.
Port-knocking signals the attacker's own implant; a tarpit never sees it.
Recommendation — None — the claim has no mechanism. Recorded so it is not re-added.
The description (honey domain controller) does not match the backing techniques (federation provider, cloud account). DOAR has no honey DC technique (finding).
Recommendation — Create a honey domain controller technique if DC-level deception is wanted.
The row itself states deception cannot address volumetric DoS.
Recommendation — None — the claim has no mechanism. Recorded so it is not re-added.
Raw-disk wipers bypass the file system and touch no backup or bucket; backup deletion is T1490, where D042 is already mapped.
Recommendation — Keep D042 on T1490 Inhibit System Recovery.
Tarpits on odd ports catch scanning (T1046), not the attacker's choice of C2 port.
Recommendation — Keep D046 on T1046 Network Service Discovery.
Acquiring infrastructure happens entirely on the attacker's side.
Recommendation — None — the claim has no mechanism. Recorded so it is not re-added.
Compromising third-party infrastructure never touches a defender lure.
Recommendation — None — the claim has no mechanism. Recorded so it is not re-added.
Sock puppets contacting a honey persona is T1598, where D055 is already mapped.
Recommendation — Keep D055 on T1598 Phishing for Information.
'Honey accounts that detect compromise of real accounts' has no mechanism.
Recommendation — None — the claim has no mechanism. Recorded so it is not re-added.
Seeded credentials in leak dumps fire when used (T1078/T1552), not when tools are obtained.
Recommendation — None — the claim has no mechanism. Recorded so it is not re-added.
Acquiring or compromising domains happens entirely on the attacker's side; the parent claim was removed in step 2 for the same reason.
Recommendation — None — recorded so it is not re-added.
Acquiring or compromising domains happens entirely on the attacker's side; the parent claim was removed in step 2 for the same reason.
Recommendation — None — recorded so it is not re-added.
D050 (honey MCP / decoy LLM) does not observe cloud-API execution; D050 is re-mapped to T1699 Direct Prompt Injection.
Recommendation — None — recorded so it is not re-added.
Known gaps
- Deployment detail is grounded in vendor documentation, with event names and defaults checked against it, but has not been tested end to end in a live account.