Azure Key Vault Honeytoken

Create a fake Azure Key Vault instance containing decoy secrets and keys. Monitor access to this vault to detect attempts to steal sensitive information.

Engage Goals: EGO0003 Elicit

Engage Approach: EAP0001 Collect

Engage Actions: EAC0015 Information Manipulation, EAC0018 Security Controls

Name of Element: Azure Key Vault Honeytoken

Description of Element:

Create a fake Azure Key Vault instance containing decoy secrets and keys. Monitor access to this vault to detect attempts to steal sensitive information.

Technical Context:

Placement: Within a resource group alongside legitimate Azure services.

Requires knowledge of Azure Key Vault configuration and access control mechanisms.

Other:

Att&ck/Engage Mapping: T1528 Steal or Forge Kerberos Tickets, E1501 Honeytrap

Leave a Reply