D3-DTP

Decoy Token Deployment

Deploy fake credentials, API keys, and tokens that alert when accessed by adversaries.

D3FEND / Deceive

Implementation

  • Plant decoy credentials in likely locations
  • Monitor for decoy usage
  • Integrate with SIEM alerting
  • Rotate decoys regularly
  • Track attacker behavior patterns

Tools

  • Thinkst Canary
  • Attivo Networks
  • Illusive Networks
  • Honeytokens
  • Custom scripts

ATT&CK mappings

3

MITRE D3FEND ↗