SDF-DP03

Credential Trap Planting

intermediateDetection Value: criticalCost: minimalTime: 1-3 days🔑 Identity & Access

Description

Plant fake credentials in locations where adversaries commonly harvest them: configuration files, environment variables, browser stores, memory, and authentication caches. When these credentials are used, they trigger immediate detection because they only exist as traps.

Rationale

Credential harvesting is one of the most universal adversary behaviors. Nearly every intrusion involves searching for stored credentials to enable lateral movement and privilege escalation. Planting fake credentials along these harvesting paths creates a detection mechanism that is independent of any specific attack technique or tool.

Supporting Basis

Direct antecedent

Honeywords are planted false passwords whose attempted use triggers an alarm.

Juels, A.; Rivest, R.L. Honeywords: Making Password-Cracking Detectable. ACM CCS 2013, 145–160.Peer reviewed

These sources establish design lineage and scope. They do not validate this record's operational effectiveness, planning estimates, environment labels, or ATT&CK relationships.

Implementation Steps

Identify credential harvesting locations

Map the locations where adversaries commonly find stored credentials in your environment: config files, environment variables, scripts, documentation, and credential stores.

Create trap credential accounts

Create accounts in your identity provider that exist solely as traps. These accounts should have enticing names (admin, svc_backup, sa_prod) but no legitimate access.

Plant credentials in harvest locations

Place trap credentials in the identified locations using formats consistent with how real credentials are stored in your environment.

Configure authentication monitoring

Set up monitoring on the identity provider to alert immediately when trap credentials are used for authentication, regardless of success or failure.

Technical Implementation Examples(1)

Credential Trap Deployment (Linux)

Plant fake credentials in common locations where adversaries harvest them on Linux systems

bash

#!/bin/bash
# plant-credential-traps.sh
# Plants fake credentials in locations adversaries routinely search.
# All credentials authenticate against deception infrastructure only.

set -euo pipefail

echo "[*] Planting credential traps..."

# 1. Fake AWS credentials in default profile location
mkdir -p /home/j.martinez/.aws
cat > /home/j.martinez/.aws/credentials << 'AWSCREDS'
[default]
# Rotated 2026-02-15 - do NOT delete
aws_access_key_id = AKIAIOSFODNN7DECOY01
aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/TrapKeyForShadowCDF
region = us-east-1
AWSCREDS
chmod 600 /home/j.martinez/.aws/credentials
chown j.martinez:j.martinez /home/j.martinez/.aws/credentials

# 2. Fake database credentials in environment file
cat > /opt/application/.env << 'ENVFILE'
# Application environment - PRODUCTION
NODE_ENV=production
PORT=3000
DB_HOST=prod-db-01.corp.internal
DB_USER=app_svc_prod
DB_PASS=Pr0d-Db#2026!xK9m
REDIS_URL=redis://cache-01.corp.internal:6379
JWT_SECRET=a3f8b2c1d4e5f6789012345678abcdef
API_KEY=sk-prod-28f3a1b5c7d9e0f234567890abcdef12
ENVFILE
chmod 640 /opt/application/.env

# 3. Fake SSH key for service account
mkdir -p /home/svc_deploy/.ssh
ssh-keygen -t rsa -b 2048 -f /home/svc_deploy/.ssh/id_rsa     -N "" -C "svc_deploy@prod-deploy-01" -q
cat > /home/svc_deploy/.ssh/config << 'SSHCFG'
Host prod-db-*
    User svc_deploy
    IdentityFile ~/.ssh/id_rsa
    StrictHostKeyChecking no

Host prod-jump-01
    User svc_deploy
    IdentityFile ~/.ssh/id_rsa
    ProxyJump bastion.corp.internal
SSHCFG
chmod 600 /home/svc_deploy/.ssh/config

# 4. Fake credentials in bash history (looks like accidental exposure)
cat >> /home/j.martinez/.bash_history << 'HISTORY'
mysql -h prod-db-01 -u root -p'R00t#Mysql_2026!'
curl -u admin:AdminP4ss#2026 https://monitoring.corp.internal/api/v1/status
ssh [email protected]
HISTORY

# 5. Fake Kubernetes config
mkdir -p /home/m.chen/.kube
cat > /home/m.chen/.kube/config << 'K8SCFG'
apiVersion: v1
kind: Config
clusters:
- cluster:
    server: https://k8s-api.corp.internal:6443
    certificate-authority-data: LS0tLS1CRUdJ...
  name: production
contexts:
- context:
    cluster: production
    user: admin
    namespace: default
  name: prod-context
current-context: prod-context
users:
- name: admin
  user:
    token: eyJhbGciOiJSUzI1NiIsImtpZCI6IkRFQ09Z...
K8SCFG
chmod 600 /home/m.chen/.kube/config

echo "[+] Credential traps planted in 5 locations."
echo ""
echo "[!] CRITICAL: Add these credentials to SIEM monitoring:"
echo "    - AWS Key: AKIAIOSFODNN7DECOY01"
echo "    - DB User: app_svc_prod"
echo "    - MySQL Root password hash in auth logs"
echo "    - SSH key fingerprint for svc_deploy"
echo "    - K8s token prefix: eyJhbGciOi..."

MITRE ATT&CK Mappings

Technique	Tactic	Relationship
T1552Unsecured Credentials	Credential Access	detects
T1078Valid Accounts	Defense Evasion	detects
T1003OS Credential Dumping	Credential Access	detects

Considerations

Trap credentials should look like real credentials, not obvious fakes. Include realistic password patterns and account naming conventions.
Ensure trap accounts cannot actually access any sensitive resources. The alert should fire before any access is granted, but defense in depth requires that the accounts are genuinely unprivileged.
Consider planting credentials at multiple privilege levels. A regular user credential and an admin credential provide different detection coverage.

Supported Environments

🏢On-Premise

☁Amazon Web Services

☁Microsoft Azure

☁Google Cloud Platform

🔄Hybrid Environment

Tools & Resources

Active Directory for trap account creation
SIEM for authentication monitoring
Credential management scripts
Cloud IAM for cloud-based trap credentials

Related Techniques

SDF-PR05Identity Ecosystem Creation

SDF-DP02Canary Token Distribution

SDF-DT05Credential Misuse Detection

Quick Stats

Phase: Deploy
Difficulty: intermediate
Detection Value: critical
Cost: minimal
Time: 1-3 days
ATT&CK Mappings: 3