Explore / Defensive questions

What behavior do you want to detect?

Start with an unexpected action. Then explore the technique, environment and sources that can inform a test.

01 / Common questions

Three starting points

IDENTITYUse of a decoy credentialWhat use should trigger an alert, and how do you rule out legitimate activity?NETWORKReconnaissance of an internal serviceWhat interaction would be unexpected, and what would responders need to know?ASSETSAccess to a decoy assetWhere should it be placed, and what risk does it introduce to the real environment?

Reference vocabulary

Name the technique

MITRE Engage helps plan deception and engagement operations; D3FEND describes decoy objects and environments. The Atlas glossary explains the labels used here.

Glossary and method →MITRE Engage →MITRE D3FEND →

02 / Techniques

What the lure does

01 / HoneypotHoneypots and honeynetsSystems and services prepared to observe interactions that ordinary operations should not produce.02 / HoneytokenHoneytokens and decoy credentialsData, credentials or identifiers created to generate a signal when someone accesses or uses them.03 / DecoyDecoy assets and objectsSimulated assets that can steer reconnaissance or make a suspicious interaction visible.04 / Adversary engagementAdversary engagementPlanned operations to observe adversary decisions and learn from them while maintaining defensive control.05 / Moving target defenseMoving target defenseDeliberate environment changes that can hinder reconnaissance. Treated as a related area when no explicit deception is involved.

03 / Environments

Where it is placed

01 / NetworkNetworks and servicesLures for network services, protocols and assets, internal or exposed.02 / IdentityIdentity and credentialsDecoy accounts, credentials and tokens linked to access and lateral movement.03 / CloudCloud and hybrid environmentsDecoy objects, permissions and workloads distributed across cloud services and hybrid integrations.04 / ApplicationApplications and APIsDecoy web services, routes and data associated with applications and APIs.05 / OT/ICSOT, ICS and critical infrastructureLures for industrial networks where process safety and lab isolation are central conditions.06 / EndpointEndpoints and workstationsDefensive lures and artifacts placed on endpoints to expose reconnaissance or misuse.07 / IoTIoT and connected devicesLures representing connected devices and protocols, with attention to isolation and telemetry.

This taxonomy guides navigation. MITRE D3FEND and Engage provide reference terminology; Atlas labels are editorial choices and are not an official MITRE classification.