CISA releases Cyber Decoys guide detailing tripwires, honeytokens to strengthen critical ...

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) released guidance that helps critical infrastructure owners and operators implement realistic decoy systems and information assets to detect and disrupt malicious activity occurring in their networks, which will ultimately improve their cyber defenses. It introduces decoy concepts, including tripwires, breadcrumbs, and honeytokens, and uses MITRE Engage and MITRE ATT&CK frameworks to provide practical, low-complexity steps for planning, implementing, and refining decoy operations.

Titled ‘ Using Cyber Decoys to Strengthen Detection and Response ,’ the document is CISA’s first guide to provide a detailed overview of defensive cyber decoy processes. It addresses a persistent detection challenge, where adversaries can use legitimate credentials, native tools and living-off-the-land techniques to conduct reconnaissance, move laterally and access data without triggering conventional defenses. CISA encourages critical infrastructure organizations to deploy cyber decoys alongside existing Zero Trust models , based on the premise that defenders should assume an attacker may eventually gain some level of network access.

“Cyber decoys used in a proactive cyber defense strategy help make critical infrastructure networks unfriendly places for adversaries and enhance resilience to compromise, even against living-off-the-land techniques,” Chris Butera, CISA acting executive assistant director for cybersecurity, said in a Wednesday media statement. “With this guide, CISA is raising awareness of cyber decoy techniques and enabling any defensive team regardless of skill level to understand the value and steps to implementing decoy operations. CISA encourages critical infrastructure organizations to review this guide and implement a cyber decoy strategy.”

The 22-page document identified that by placing decoys within internal networks and systems, organizations can detect, observe, and impeded malicious activity early in the intrusion lifecycle. When implemented effectively, cyber decoys enable defenders to detect adversaries operating within the environment, gather and analyze cyber threat information (CTI) derived from intrusions and attempted intrusions, allocate defensive resources more effectively based on observed adversary behaviors, and reduce mean time to detection (MTTD) by generating high-fidelity alerts.

Zero Trust assumes no user, device, or network segment is inherently trustworthy and requires organizations to assume compromise has occurred. Cyber decoys align with this paradigm by validating Zero Trust assumptions through revealing unwanted internal activity, increasing detection coverage for post-compromise and LOTL techniques, and introducing controlled, high-signal indicators of malicious behavior. Decoy techniques are incremental, cost-effective, and scalable, enabling organizations to implement them without major architectural changes.

Decoys, also called lures, are assets that appear to be legitimate systems, accounts, or data but are designed to distract adversaries, detect their presence, or facilitate collection of cyber threat intelligence. Tripwires are decoys configured such that any interaction, including access, authentication attempts, or command execution, generates an alert. Any decoy can function as a tripwire if integrated with appropriate monitoring and alerting systems.

Breadcrumbs are intentionally placed decoy artifacts that adversaries are encouraged to follow, leading to other decoy assets or controlled environments. Honeytokens are data elements or logical objects with no legitimate business use, such as fake records, credentials, or files, planted to detect unauthorized access or exfiltration. Any interaction with honeytokens strongly suggests malicious or otherwise unauthorized activity. Honeypots are decoy systems or services, often with limited but realistic functionality and intentional vulnerabilities, designed to attract and observe adversaries and divert them from real assets.

These decoy mechanisms work together to extend visibility into post-compromise behavior while forcing attackers to reveal themselves through interaction with controlled assets.

The Engage framework provides a structured methodology for planning, implementing, and assessing adversary engagement activities, including cyber decoys. It offers the MITRE Engage Matrix, a tool that organizes engagement activities by defensive goals and maps them to ATT&CK tactics and techniques. The framework also provides a Practical Guide of Adversary Engagement with comprehensive information on cyber decoys and broader adversary engagement concepts, along with scalable step-by-step processes and implementation best practices.

Engagement goals fall into three categories, including Expose, which detects adversaries operating in or against the environment; Affect, which imposes cost on adversaries, disrupts their operations, and reduces the value of their actions; and Elicit, which safely observes adversaries to collect high-value, real-time cyber threat intelligence.

Expose operations reveal adversaries quickly and clearly by placing decoys in locations where legitimate users should rarely or never interact with them and configuring decoys to produce high-fidelity alerts when accessed, executed, or otherwise engaged. Planting fake admin-only credentials signals compromise through any use. Creating decoy folders on executive desktops makes any access suspicious. Placing a fake network-scanning tool on a nontechnical user’s workstation indicates malicious activity through execution. These mechanisms ensure that adversary interaction with decoys generates immediate, reliable detection signals.

Affect operations aim to increase the cost and difficulty of attacks by diverting adversary effort toward decoy systems or data. Organizations can seed environments with decoy accounts, services, and credentials so adversary reconnaissance produces a misleading understanding of the environment. Adversaries can be encouraged to exfiltrate or process large volumes of non-sensitive or meaningless data, consuming their time and resources. Although Affect operations do not remove adversaries from the environment, they create additional opportunities for detection, delay adversary objectives, and provide defenders with more time to respond.

Elicitation operations involve placing adversaries into controlled, realistic environments designed to encourage them to conduct operations as they would in a real environment, enable detailed observation of their tactics, techniques, and procedures, and support the collection of cyber threat intelligence to inform broader defensive efforts. To conduct elicitation safely, organizations generally require highly realistic but isolated environments, mature monitoring and logging capabilities, and skilled personnel capable of managing the associated operational and legal risks. Organizations should first establish basic Expose capabilities and, where appropriate, selected Affect activities before considering Elicit operations.

A medium-sized high-technology organization is concerned that threat actors will target their intellectual property. The Chief Information Security Officer (CISO) decides to implement internal decoy operations to detect adversaries who bypass perimeter defenses, reduce mean time to detect (MTTD), and mitigate risk associated with phishing-prone executives.

In the Prepare Phase, the organization first assesses knowledge of adversaries and itself. Cyber threat intelligence indicates that likely adversaries typically execute their tactics, techniques, and procedures (TTPs) in a specific order. Adversaries obtain initial access via phishing, particularly targeting technical leaders and IT staff. They then conduct discovery for files, shares, and email, followed by stealing credentials and escalating privileges. Once privileged, they move laterally to restricted servers before exfiltrating technical data via HTTP or other channels. The organization employs firewalls, regular patching, antivirus, endpoint detection and response (EDR), and centralized logging, along with user phishing training. However, detection of lateral movement and anomalous user access remains limited. Additionally, several executives have repeatedly failed phishing simulations, indicating elevated risk.

After consultation with IT, managed security service providers (MSSPs), and legal counsel, the CISO determines the operational objective: enhancing the organization’s ability to detect intruders who have obtained an internal foothold, with particular emphasis on detecting compromised executive accounts and the early stages of lateral movement. The defensive team then determines how they want adversaries to react. Once inside the network, they want adversaries to gravitate toward decoy assets and conduct actions that produce unmistakable, high-priority alerts. The team therefore selects a strategy that emphasizes decoy assets configured as tripwires.

Using cyber threat intelligence and their understanding of adversary objectives, the team designs decoys that appear to be high-value credentials suitable for lateral movement and privilege escalation. The decoys also appear to be sensitive technical documents and project data of interest to intellectual property thieves. The intent is for adversaries to regard these decoys as legitimate and valuable targets.

The team identifies likely adversary paths and deploys decoys accordingly. An internal ‘dark net’ segment of unused IP space is routed to a sinkhole, and network scanning against this range generates alerts. File shares are created mimicking current research and development projects, populated with realistic but non-sensitive documents, with legitimate users instructed not to access these shares. Emails are sent to previously identified phishing-prone executives containing apparent credentials and links to document shares, with executives instructed to retain but not use these credentials as use indicates unauthorized access. Logging and alerting integrates all decoys so that interactions result in promptly visible signals.

The team defines success criteria as decoy alerts being the primary indication of an intrusion or, if not the primary indication, significantly assisting investigations triggered by detections from other security tools. A demonstrable reduction in MTTD when decoys are the detection source compared to prior incidents or baselines also constitutes success.

The team documents decoy locations and expected alerts, noting that decoy location documentation should be kept outside of the production environment to reduce exposure if the network is compromised. They develop investigative procedures and identify expected false positives such as IT testing activities. The team uses secure communications channels not dependent on the monitored network to coordinate decoy planning.

In the Operate Phase, the team deploys decoys during a scheduled maintenance window and conducts testing to confirm that each decoy correctly generates alerts when interacted with. The team informs leadership of objectives and high-level design but restricts detailed decoy information to required personnel. Subsequently, adversaries trigger the decoy alerts, and because decoy interactions are rare and designated as high priority, analysts can quickly triage and escalate to incident response procedures.

In the Understand Phase, the team turns raw data into actionable intelligence and provides feedback. During and after the incident, the team collects data on the triggered decoys, including when and how they were accessed. The team reconstructs the adversary’s sequence of actions. This information refines detection content and correlation logic and updates incident response playbooks and workflows. After concluding the investigation, the team assesses investigation results against success criteria and identifies detection gaps and weaknesses in existing controls. This information improves decoy placement, configuration, and coverage for future operations.

Organizations frequently encounter high volumes of alerts, many of which are false positives. Limited analyst capacity leads to alert fatigue, and difficulty detecting stealthy or post-compromise activity persists, especially when adversaries use native tools and legitimate credentials. Decoy-based Expose operations help address these challenges by generating high-fidelity alerts that represent behaviors with little or no legitimate use. Decoys reduce noise since interactions with decoys should be rare in normal operations. They also provide earlier and clearer indications of compromise, reducing mean time to detect. Decoys are particularly valuable against living off the land techniques where traditional signature-based approaches are less effective.

Decoy operations provide organizations with additional capabilities to detect adversaries in their environment by using tripwires specifically designed to expose adversary activities to defenders. Effective tripwires should be threat-informed, designed based on current cyber threat intelligence and an organizational threat model. They must be distinct from normal behavior such that any interaction is inherently unusual or unauthorized. Tripwires must be detectable and properly instrumented to generate alerts in existing monitoring systems. They should also be actionable, tied to clear investigation and response procedures.

Successful tripwire design requires addressing two fundamental questions: what threats does the organization face and how is adversary behavior distinct from normal user behavior? Organizations should use documented cyber threat intelligence, including CISA advisories and sector-specific information, to identify likely adversaries and their tactics, techniques, and procedures. These can be mapped to the ATT&CK framework, with tripwires designed to intersect those TTPs.

Numerous situations employ tripwires effectively. Organizations can protect critical assets or data by deploying decoy shares and files that resemble sensitive repositories such as financial records, proprietary designs, or customer data.

Alerts should be configured so that any interaction with these decoys is an indicator of compromise. Organizations can protect key personnel by placing decoys on executive workstations, within email accounts, or in personal network shares. Any access to these decoys signals account compromise or targeted activity against high-value users. Tripwires can also cover known vulnerabilities or weaknesses by serving as compensating controls where remediation is delayed or complex. For example, if typical users do not require PowerShell, organizations can configure alerts for PowerShell execution on workstations to detect potential malicious use.

An effective honeytoken strategy deploys multiple token types, including files, accounts, credentials, and URLs. These tokens are placed in multiple locations such as key servers, workstations, cloud repositories, and identity systems. The strategy utilizes cyber threat intelligence and knowledge of likely attack paths. This diversity increases the probability that adversaries who bypass one set of controls will encounter and trigger others. It also helps defenders infer adversary objectives and movement based on accessed tokens.

Organizations may deploy honeytokens using several approaches. Open-source solutions provide freely available tools and frameworks that support token generation, deployment, and alerting. These are suitable for pilot projects and organizations with limited budgets. Commercial solutions offer products that provide integrated deception and honeytoken management capabilities, sometimes as part of broader endpoint detection and response or security platforms. These typically offer centralized dashboards, reporting, and vendor support.

Homegrown or in-house implementations involve custom-developed capabilities tailored to an organization’s specific environment and toolset. These approaches are appropriate for organizations with sufficient development and security engineering capacity. LOTL approaches use existing tools and capabilities such as endpoint detection and response platforms, identity and access management systems, and data loss prevention tools to deploy and monitor honeytokens. This approach allows organizations to introduce decoy capabilities without procuring additional tooling.

When evaluating options, organizations should consider interoperability with existing security infrastructure, operational complexity, staffing, and budget. These factors collectively determine which honeytoken sourcing approach best aligns with organizational capabilities and constraints.

The CISA guidance cited a medium-sized water and wastewater sector organization that decides to enhance its detection capabilities with decoys by leveraging the ATT&CK Framework and a structured planning process. The organization begins by establishing situational awareness through identifying data sources and gathering information, consistent with Engage’s Prepare Phase Step 1. This foundational work involves collecting and documenting inventories of IT and operational technology assets, network diagrams and architecture, existing defenses and detection capabilities such as firewalls, endpoint detection and response systems, security information and event management platforms, and identity controls.

The organization moves on to review relevant logs, detection rules, monitoring coverage, results from penetration tests, red team exercises , audits, and cyber threat intelligence relevant to the sector and environment. This factual basis enables comprehensive understanding of both the defensive environment and the threat landscape.

The organization then maps vulnerabilities, defender capabilities, and adversary capabilities to the ATT&CK Framework using this collected information. By identifying which ATT&CK tactics and techniques apply to its systems and configurations, the organization determines high-priority techniques such as phishing targeting corporate email systems, valid accounts and external remote services potentially compromising operational technology human-machine interfaces, and command and scripting interpreter techniques including PowerShell-based activity on IT systems.

Concurrently, the organization evaluates its existing defensive and detection capabilities and maps them to ATT&CK techniques, including endpoint detection and response and security information and event management coverage, network protections through firewalls and segmentation, identity and access management controls, and incident response capabilities. Using cyber threat intelligence and historical incident data, the organization identifies threat actors likely to target the sector, determines the specific ATT&CK tactics and techniques those actors employ, and consolidates all three mappings into a unified view that enables direct comparison among vulnerabilities, defensive coverage, and adversary capabilities.

The integrated mapping enables the organization to conduct a comprehensive gap analysis by overlaying vulnerabilities, defensive coverage, and adversary capabilities. This analysis identifies techniques for which the environment is vulnerable and adversaries are known to operate, but defenses and detections are weak or absent, representing high-risk gaps.

The organization identifies significant gaps in detecting phishing activity beyond user reports, LOTL techniques involving PowerShell, and exfiltration targeting cloud backups. These gaps, combined with demonstrated adversary capabilities, form the basis for setting decoy-focused operational objectives and appropriate measures of success, directly informing Engage’s Prepare Phases Step 2 on determining operational objectives and Step 6 on determining success and gating criteria. By explicitly framing objectives around specific techniques and attack paths where coverage is weak, the organization can design decoy operations with measurable, focused outcomes.

After decoys and tripwires are deployed, the organization should conduct threat emulation , red teaming , or purple teaming that uses relevant ATT&CK techniques to test the decoy operation. The organization must verify that decoys are triggered as expected and that alerts are surfaced to and handled by defenders in a timely and appropriate manner, consistent with Engage Step 7.

The organization should collect raw data on decoy interactions and defender responses and convert it into actionable intelligence regarding both adversary-like behaviors and defensive performance, as outlined in Engage Step 8. This intelligence should be used to refine operational objectives, improve decoy placement, and adjust detection logic and incident workflows, fulfilling MITRE Engage Step 9. The organization should perform a structured review of successes, failures, and residual gaps to inform subsequent iterations of decoy operations, completing Engage Step 10. This step completes the mapping between the ATT&CK and Engage planning process and the full Engage lifecycle, reinforcing that decoy operations should be continuous and iterative.

In a practical example, the organization engages a third-party red team to emulate a ransomware campaign targeting operational technology configuration documents and cloud backups. Initial access is established via a controlled malicious executable on an IT workstation, after which the red team conducts reconnaissance, privilege escalation, and lateral movement.

During reconnaissance, execution of a seeded network-scanning utility, which functions as a sensitive command token, triggers a decoy alert. Subsequent alerts are generated when the red team attempts to access a decoy remote service and authenticate using a decoy Active Directory account. The security team tracks the red team’s actions, validates incident response performance, and identifies areas where detection, decoy placement, or response procedures require improvement. Attack and Control Framework mappings and decoy deployments are updated accordingly, and the organization plans follow-on exercises to maintain alignment with evolving threats and infrastructure changes.