The tripwires a Red Team should hit: honey accounts, canary files and decoy records

A tripwire is a detection with no baseline to hide under

A Red Team operator's craft is staying under thresholds. Each alert your SOC tunes has a baseline, the volume of ordinary activity it has to ignore. The operator's job is to look like that activity: one logon where a hundred would fire, one share read instead of a sweep, a beacon that sleeps for an hour between check-ins. What your SOC should catch during a Red Team set out the signal each phase leaves behind and where. This article is about the signals that have no baseline at all. A tripwire is an account, a file, a host or a record that no legitimate process ever touches, so a single touch is the whole alert. There is nothing to tune and nothing to stay under.

The idea is old and it is standard. NIST SP 800-53 carries it as control SC-26, concealment and misdirection through decoys. MITRE's D3FEND catalogues decoy accounts, files, credentials and hosts as defensive techniques in their own right. What a Red Team adds is the test. An operator who does not know the wires exist, working towards an objective you named, either touches one on the way or does not. Both outcomes are worth the price. A tripped wire is a detection you can time to the second. A wire that stayed silent through a full chain to the crown jewel was laid in the wrong place, and the report shows where the operator actually walked.

Six tripwires, and what an operator does to trip each one

A tripwire earns its place by sitting on something an operator has to do. Reading the directory, asking for service tickets, listing shares, opening documents, reaching the record that is the objective: each is a step on the way to a named crown jewel. Each can be given a decoy that looks like the real thing and reports when it is touched. The table lists six, from the first hours of an intrusion to the last. Beside each is the action that trips it and what the alert has to carry to be acted on. D3FEND names the general techniques; these are the specific objects.

Two rules separate a tripwire from a decoration. First, the decoy has to be indistinguishable from its neighbours to someone reading the directory or the share listing. That means an ordinary name, a plausible creation date, a description like the real ones, and no group called Honeypots. Operators look for the tells. An account with no logon history is one, and so is a file last modified on the day the engagement started. Second, the alert has to name the object and the touch, not the class. An alert that reads honey account queried from a named workstation at a named time is one an analyst acts on. An alert that reads deception event is one they close.

One chain, with the tripwires drawn in

The figure draws a chain the way an operator would run it against a Windows estate, and where two wires sit in it. The foothold is a phished workstation. From it the operator reads the directory, which is quiet and expected, because the names are needed before anything else. The next step is where the first wire sits. The operator requests a service ticket for every account that carries a service principal name, so the weak passwords among them can be cracked offline: the technique ATT&CK lists as Kerberoasting. The operator asks for all of them, because asking for all is how the weak one is found. One of them is the decoy. The domain controller records that request as it records every other. The wire is the rule that says this particular name is never legitimately requested.

The second wire is the last. Cracking a real service account with a weak password is the vulnerability the chain turns on. It opens the file server and, through it, a path to the customer database that is the objective. The decoy record sits inside that database, and the query that proves reach returns it. Two wires, and a chain that stayed under every tuned threshold tripped both. A Red Team engagement scores each as a detection only if the alert became a ticket in time, which is the next section. Note what the wires did not cover. The phish, the beacon and the lateral movement all went unremarked, and that is the honest reading of a SOC whose only working detections are the two decoys.

When a tripped wire counts as detected

A wire that fires into a log nobody reads is logged only, and the verdict is the same one the SOC article gives for any other signal. The alert has to reach an analyst, become a ticket, and be escalated to the white team, who timestamp it against the operator's log. The interval between the operator's action and the white team's call is the number the report carries. The white team named in the authorisation letter is the same one that answers the SOC's call here, and the same rule applies. A SOC that ends the engagement by containing the workstation has done the job correctly, and the report says so before it says anything about the wires.

Three outcomes are worth recording separately, because each leads to different work. A wire that fired and was acted on is a detection, and time to ticket is its measure. A wire that fired and was closed as noise is a triage failure, not a detection failure. The fix is the alert's wording and the runbook beside it, not the decoy. A wire the operator walked past is a placement failure, and the report's chain shows the step it should have sat on. Only the first is a pass. Do not accept the second as one because the event exists in the SIEM. That is the argument the detection you need before a Red Team is worth buying makes about every alert, and tripwires are no exception.

Laying the wires before the engagement, and keeping them after

The SOC builds the wires and the operators are not told. That is the point of the test, and it holds even where the same provider runs both sides later: the Red Team lead does not see the decoy list. The wires go in weeks ahead, so their creation dates age past the engagement's start, and they are named by the same convention as their neighbours. The matrix orders what to lay first. Cost is the hours needed to build a wire and keep it believable. Reach is how far along the chain it sits. A wire inside the objective catches a chain that avoided everything else, while a wire at the directory catches the widest set of chains earliest. In each row, the cheap cell comes before the expensive one.

After the engagement, the report lists which wires fired and which the operators saw through, and both lists are the SOC's to act on. A wire that fired is now known to the operators, and in a real intrusion may be known to an attacker who reads the same report. So it is rotated: same class, new name, new place. A wire that was walked past is moved to the step the chain shows. The alert rule behind each wire is detection content the SOC owns. A purple team session is where it is tested against the technique rather than against one operator's route. An assumed breach exercise is the cheaper way to re-run the chain against the moved wires without paying for a second route in.

Tripwires in Dubai and Abu Dhabi: proof the monitoring acts, not only collects

Every UAE regime that names security testing also requires logging and monitoring, and an examiner reading a Red Team report in either emirate wants evidence that the monitoring does something. A bank supervised by CBUAE carries a monitoring obligation. So does a Dubai government entity or supplier held to the DESC Information Security Regulation, an Abu Dhabi healthcare provider under ADHICS, and a federal entity under the UAE Information Assurance Standards. What those instruments say about deception specifically is little or nothing, and this article does not claim otherwise. A tripped wire with a time to ticket is the plainest evidence that the SOC acts on what it collects, which is the question behind every one of those controls.

The practical difference between the two emirates is who runs the SOC. A Dubai entity whose monitoring is outsourced to a managed provider needs the decoys and their alert rules written into that provider's contract. A wire the provider's analysts were never told about is one they close as noise, and the DESC regulation holds the entity, not the provider, to the outcome. In Abu Dhabi, a hospital under ADHICS can put a decoy patient record inside the clinical system. The record has to be synthetic and marked as such in the system's own terms, so that no clinician acts on it and no real patient's data is used as bait. Federal entities and critical infrastructure in both emirates under the UAE Information Assurance Standards are in the same position. Which regime reads your report is set out in the UAE regulation explainer on this site. The wires read the same to all of them: a timestamp, a ticket, and a chain drawn beside it.

Frequently asked questions