SDF-DT05

Credential Misuse Detection

intermediateDetection Value: criticalCost: minimalTime: 1-3 days🔑 Identity & Access

Description

Detect attempted use of planted credentials across monitored authentication systems. Because these credentials should be excluded from legitimate workflows, an attempt is a high-suspicion event that requires investigation and confirmation of its source.

Rationale

Trap credentials can provide a focused signal when they are carefully governed and excluded from legitimate use. Detection relies on monitoring authentication systems for identifiers that should not appear in ordinary flows. Authorized tests, credential-handling errors, and unintended exposure must be ruled out before attributing an attempt to an adversary.

Supporting Basis

Direct antecedent

The honeychecker detects submission of a honeyword and raises an alarm.

Juels, A.; Rivest, R.L. Honeywords: Making Password-Cracking Detectable. ACM CCS 2013, 145–160.Peer reviewed

These sources establish design lineage and scope. They do not validate this record's operational effectiveness, planning estimates, environment labels, or ATT&CK relationships.

Implementation Steps

Inventory trap credentials

Compile a complete list of all trap credentials deployed across the environment, including usernames, password hashes, API keys, and service account credentials.

Configure authentication monitoring

Set up monitoring on all authentication systems (AD, LDAP, SSO, cloud IAM) to alert on any authentication attempt using trap credentials.

Build detection rules

Create specific detection rules for each trap credential. Include both successful and failed authentication attempts, as both indicate adversary activity.

Define response procedures

Establish immediate response procedures for trap credential alerts, including source identification, scope assessment, and containment actions.

Technical Implementation Examples(2)

Sigma Rule - Trap Credential Authentication

Sigma rule detecting any authentication attempt using planted trap credentials across all systems

yaml

# sigma/rules/shadow-cdf/trap-credential-usage.yml
title: ShadowMatrix CDF Trap Credential Authentication Attempt
id: a1b2c3d4-e5f6-4789-0123-456789abcdef
status: stable
description: >
  Detects authentication attempts (successful or failed) using
  credentials that were planted as traps in the deception operation.
  Any use of these credentials indicates an adversary has harvested
  them from a location where they were deliberately planted.
references:
  - https://shadow-cdf-matrix.internal/technique/SDF-DT05
author: ShadowMatrix CDF
date: 2026/03/28
tags:
  - attack.credential_access
  - attack.t1078
  - shadow_cdf.credential_trap
severity: critical

logsource:
  category: authentication

detection:
  # Trap user accounts (from SDF-PR05 and SDF-DP03)
  trap_users:
    TargetUserName|contains:
      - 'svc_sql_backup'
      - 'svc_deploy_prod'
      - 'r.nakamura'
      - 'd.okafor'
      - 'app_svc_prod'
      - 'billing_svc'
      - 'dba_admin'
      - 'report_readonly'
      - 'backup_svc'

  # Trap service principal names (Kerberoasting detection)
  trap_spns:
    ServiceName|contains:
      - 'MSSQLSvc/prod-db-04'
      - 'HTTP/deploy.corp.internal'

  condition: trap_users or trap_spns

falsepositives:
  - None expected - these accounts have no legitimate use
level: critical

fields:
  - TargetUserName
  - IpAddress
  - LogonType
  - WorkstationName
  - AuthenticationPackageName

CloudTrail Alert for Decoy AWS Key Usage

Lambda function that monitors CloudTrail for any API call using decoy IAM access keys

cloud-awspython

"""
AWS Lambda: Monitor CloudTrail for decoy IAM key usage.
Triggers SNS alert when any API call uses planted decoy credentials.
Deploy as a CloudWatch Logs subscription filter on CloudTrail log group.
"""
import json
import gzip
import base64
import boto3
import os
from datetime import datetime

sns = boto3.client("sns")
ALERT_TOPIC = os.environ["ALERT_SNS_TOPIC_ARN"]

# Decoy access key IDs to monitor (from SDF-PR05)
DECOY_KEY_IDS = {
    "AKIAIOSFODNN7DECOY01": "svc-deploy-admin (planted in .env files)",
    "AKIAI44QH8DHBEXAMPL2": "svc-backup-s3 (planted in backup scripts)",
}

def handler(event, context):
    # Decode and decompress CloudWatch Logs data
    payload = base64.b64decode(event["awslogs"]["data"])
    log_data = json.loads(gzip.decompress(payload))

    for log_event in log_data.get("logEvents", []):
        try:
            ct_event = json.loads(log_event["message"])
        except (json.JSONDecodeError, KeyError):
            continue

        access_key = (
            ct_event.get("userIdentity", {}).get("accessKeyId", "")
        )

        if access_key in DECOY_KEY_IDS:
            alert = {
                "alert": "CRITICAL: Decoy AWS Credential Used",
                "source": "shadow-cdf-cloudtrail-monitor",
                "timestamp": datetime.utcnow().isoformat() + "Z",
                "decoy_key_id": access_key,
                "decoy_context": DECOY_KEY_IDS[access_key],
                "api_call": ct_event.get("eventName", "unknown"),
                "source_ip": ct_event.get("sourceIPAddress", "unknown"),
                "user_agent": ct_event.get("userAgent", "unknown"),
                "aws_region": ct_event.get("awsRegion", "unknown"),
                "error_code": ct_event.get("errorCode", "none"),
                "raw_event": ct_event,
            }

            sns.publish(
                TopicArn=ALERT_TOPIC,
                Subject="CRITICAL: ShadowMatrix CDF - Decoy AWS Key Used",
                Message=json.dumps(alert, indent=2),
            )

            print(f"ALERT: Decoy key {access_key} used from "
                  f"{alert['source_ip']} - {alert['api_call']}")

MITRE ATT&CK Mappings

Technique	Tactic	Relationship
T1078Valid Accounts	Defense Evasion	detects
T1110Brute Force	Credential Access	detects

Considerations

Monitor for trap credential usage across all authentication systems, not just the one the credential was designed for. An adversary may try harvested credentials against multiple systems.
Failed authentication attempts with trap credentials are as important as successful ones. Both indicate the adversary found and attempted to use the credential.
Ensure trap credentials are included in password spray detection logic. If an adversary sprays a list of passwords that includes a trap credential, that spray attempt should be flagged.

Supported Environments

🏢On-Premise

☁Amazon Web Services

☁Microsoft Azure

☁Google Cloud Platform

🔄Hybrid Environment

Tools & Resources

SIEM platforms with authentication log ingestion
Identity provider audit logs
Cloud IAM monitoring (CloudTrail, Azure Activity Log)
Custom detection rules

Related Techniques

SDF-DP03Credential Trap Planting

SDF-LR03Credential Breadcrumb Trails

Quick Stats

Phase: Detect
Difficulty: intermediate
Detection Value: critical
Cost: minimal
Time: 1-3 days
ATT&CK Mappings: 2