DOAR, Valeros et al. and MITRE Engage
Three efforts relate deception to MITRE ATT&CK. They answer different questions, so the honest comparison is side by side rather than a single score. Every number on this page is computed from the data at build time.
At a glance
| MITRE Engage | Valeros et al. (2026) | DOAR | |
|---|---|---|---|
| Question answered | Which engagement activities expose an adversary behaviour? | Can a decoy sit in the path of this technique? | Which decoy, where, which event fires, how strong is the evidence, and what do you do next? |
| ATT&CK version | Mapped at Engage v1.0 (2022) | v18.1 | v20.0 |
| Coverage | 93 techniques mapped to the Lures activity (122 to any deception activity) | 71 of 216 techniques rated feasible (47 high, 24 medium) | 138 of 227 mapped · 100 strong + moderate · 42 strong |
| Grading | None | Four criteria per technique (feasibility, interaction, intelligence yield, malice fidelity) | Strong / moderate / weak per mapping, from published evidence; status follows the grade |
| Evidence per mapping | No | A written rationale per technique | Linked, dated sources on every mapping row |
| Environment-specific | No | No — infrastructure in general | Yes — cloud, Kubernetes, identity, endpoint, SaaS, CI/CD, AI agents |
| Where the decoy fires | No | No | Yes — direct, inside a decoy, or at a later step |
| Deployment, alerting, response | Activity descriptions | Out of scope | Deployment detail for 89 of 89 techniques (the rest pending), alert paths and T0–T4 response tiers |
| Sub-techniques | No | No | Yes |
| ATT&CK v20 AI techniques | No | No (predates v20) | T1696 strong · T1698 moderate · T1699 weak · T1700 moderate |
Against Valeros et al. (2026)
Valeros et al. score 216 ATT&CK v18.1 techniques for whether infrastructure deception is feasible; 213 of them still exist in v20.0. Their site counts technique–tactic pairs (80 of 250); per technique it is 71. The table compares DOAR at each evidence level with their feasible set.
| DOAR level | DOAR techniques | Both | DOAR only (they rate infeasible) | Not scored by them (new in v20) |
|---|---|---|---|---|
| All mapped | 138 | 69 of 71 | 64 | 5 |
| Strong + moderate | 100 | 59 of 71 | 37 | 4 |
| Strong | 42 | 33 of 71 | 8 | 1 |
Where DOAR goes further: 37 techniques they rate infeasible, backed here at strong or moderate
Most are environment-specific: actions that sweep every resource in a cloud or directory (snapshot deletion, bulk password resets, mass re-ACLs) and so touch a decoy, or behaviour observed once an attacker is inside a high-fidelity decoy.
| Technique | Grade | Fires | Decoys | Key evidence |
|---|---|---|---|---|
| T1003 OS Credential Dumping | strong | later step | D043 | DCEPT — Domain Controller Enticing Password Tripwire |
| T1011 Exfiltration Over Other Network Medium | moderate | later step | D018 | Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) |
| T1033 System Owner/User Discovery | moderate | later step | D003 | Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) |
| T1037 Boot or Logon Initialization Scripts | moderate | later step | D059 D076 | 4663(S) An attempt was made to access an object |
| T1053 Scheduled Task/Job | moderate | later step | D059 | 4663(S) An attempt was made to access an object |
| T1055 Process Injection | moderate | direct | D045 | Sysmon (System Monitor) — event reference |
| T1056 Input Capture | strong | later step | D043 D044 D087 | BotSwindler: Tamper Resistant Injection of Believable Decoys in VM-Based Hosts for Crimeware Detection |
| T1068 Exploitation for Privilege Escalation | moderate | inside a decoy | D011 D012 | Cowrie — SSH and Telnet honeypot |
| T1070 Indicator Removal | moderate | direct | D033 D035 | Logging management events — AWS CloudTrail User Guide |
| T1082 System Information Discovery | strong | inside a decoy | D011 | Cowrie — SSH and Telnet honeypot |
| T1105 Ingress Tool Transfer | strong | inside a decoy | D011 D027 | Cowrie — SSH and Telnet honeypot · Container Orchestration Honeypot: Observing Attacks in the Wild |
| T1134 Access Token Manipulation | moderate | later step | D010 D043 | Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) |
| T1136 Create Account | moderate | later step | D001 D005 D041 | Logging management events — AWS CloudTrail User Guide · AWS API Keys token — Canarytokens documentation |
| T1199 Trusted Relationship | moderate | direct | D001 D040 D041 | Logging management events — AWS CloudTrail User Guide |
| T1222 File and Directory Permissions Modification | moderate | direct | D015 D018 | 4670(S) Permissions on an object were changed |
| T1489 Service Stop | moderate | direct | D011 D013 D035 D086 | Deception Engineering: exploring the use of Windows Service Canaries against ransomware |
| T1490 Inhibit System Recovery | moderate | direct | D030 D042 | Logging management events — AWS CloudTrail User Guide |
| T1496 Resource Hijacking | strong | direct | D006 D011 D012 D013 D067 | CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys · Docker Honeypot Reveals Cryptojacking as Most Common Cloud Threat |
| T1529 System Shutdown/Reboot | moderate | inside a decoy | D011 D035 | Cowrie — SSH and Telnet honeypot |
| T1531 Account Access Removal | strong | direct | D001 D003 | Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) |
| T1534 Internal Spearphishing | moderate | direct | D003 | Message trace in the new EAC in Exchange Online |
| T1538 Cloud Service Dashboard | moderate | direct | D034 D037 D038 | Logging management events — AWS CloudTrail User Guide |
| T1539 Steal Web Session Cookie | strong | later step | D044 | Browser Honeytoken Detection for Infostealers |
| T1546 Event Triggered Execution | moderate | direct | D013 D032 | Logging management events — AWS CloudTrail User Guide |
| T1547 Boot or Logon Autostart Execution | moderate | later step | D058 D059 | 4663(S) An attempt was made to access an object |
| T1556 Modify Authentication Process | moderate | direct | D003 D004 | Logging management events — AWS CloudTrail User Guide |
| T1557 Adversary-in-the-Middle | strong | direct | D047 | A simple and effective way to detect Broadcast Name Resolution Poisoning · Respounder — detect Responder in your network |
| T1560 Archive Collected Data | moderate | later step | D018 | Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) |
| T1563 Remote Service Session Hijacking | moderate | inside a decoy | D011 | Cowrie — SSH and Telnet honeypot |
| T1565 Data Manipulation | moderate | direct | D018 D019 | 4663(S) An attempt was made to access an object |
| T1569 System Services | moderate | inside a decoy | D011 D059 | Cowrie — SSH and Telnet honeypot |
| T1570 Lateral Tool Transfer | moderate | direct | D017 D018 | 4663(S) An attempt was made to access an object |
| T1574 Hijack Execution Flow | moderate | direct | D045 D058 | 4663(S) An attempt was made to access an object |
| T1578 Modify Cloud Compute Infrastructure | moderate | direct | D011 D016 D042 | Logging management events — AWS CloudTrail User Guide |
| T1589 Gather Victim Identity Information | moderate | later step | D055 | Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) |
| T1590 Gather Victim Network Information | moderate | later step | D024 D055 | Canarytokens token guides (MS Word, Windows Directory, Network Folder, Kubeconfig, AWS Infrastructure, DNS, Azure Login Certificate, MySQL Dump) |
| T1621 Multi-Factor Authentication Request Generation | moderate | direct | D003 | Microsoft Defender for Identity classic security alerts (honeytoken alerts 2014, 2427, 2428, 2429) |
Where they go further: 12 techniques they rate feasible that DOAR does not back at strong or moderate
Listed, not hidden. Several are discovery techniques where merely listing objects produces no per-object event — a limit that applies to any decoy, theirs included.
T1007 · weak T1047 · weak T1049 · weak T1057 · weak T1120 · not mapped T1216 · weak T1218 · weak T1220 · weak T1221 · weak T1518 · weak T1593 · weak T1669 · not mapped
Against MITRE Engage
MITRE Engage maps 93 ATT&CK techniques to its Lures activity — MITRE's own statement that a decoy can engage the adversary there. DOAR backs 54 of them at strong or moderate, and cites Engage as supporting evidence on those mappings. DOAR also covers 46 techniques at strong or moderate that Engage does not list under Lures, including techniques added to ATT&CK after Engage was published:
T1037 T1055 T1059 T1070 T1082 T1105 T1134 T1136 T1217 T1222 T1482 T1484 T1486 T1489 T1490 T1496 T1525 T1534 T1546 T1547 T1556 T1565 T1566 T1569 T1570 T1574 T1598 T1609 T1610 T1611 T1612 T1615 T1619 T1621 T1648 T1649 T1651 T1654 T1671 T1673 T1675 T1677 T1685 T1696 T1698 T1700
Research agenda — not counted anywhere
Candidates without a verified source, or with counter-evidence. They appear in no coverage figure and on no matrix cell.
Valeros et al. rate T1669 feasible; DOAR has no decoy for it and no source has been checked.
Valeros et al. themselves rate the feasibility as mostly no.
An application-specific password issued on a decoy account; covers a technique new in ATT&CK v20.
Gakh & Bahsi (2025) found canary-word checks in Rebuff and Vigil failed to catch prompt-leak attacks; a usable fake credential in the prompt is unstudied.
A decoy guardrail or automated-response policy whose change alerts; covers a sub-technique new in ATT&CK v20.
The macOS counterpart of registry honey keys; no source checked yet.
Several Valeros feasibility ratings assume a decoy DC; DOAR covers those techniques with honey accounts instead.
No ATT&CK v20 technique describes an attacker operating through an AI agent, which is what D072 traps; it is also an active measure.
Caveats
- The three answer different questions; overlap counts compare coverage, not quality.
- Valeros et al.: ATT&CK v18.1; companion data, CC BY 4.0 — Valeros, Catania, Lisý, Griffioen (2026). The paper itself was not yet public when this page was built.
- MITRE Engage: Apache-2.0 — MITRE Engage v1.0; mapped against an earlier ATT&CK release. T1562 entries are carried to its v19.2 successors.
- DOAR's grades follow the published evidence attached to each mapping; see Methodology and Evidence.