SDF-LR03

Credential Breadcrumb Trails

intermediateDetection Value: highCost: minimalTime: 2-5 days🔑 Identity & Access

Description

Create discoverable trails of credential-related artifacts that lead adversaries from their current position toward deception infrastructure. This includes cached credentials, stored sessions, and authentication artifacts placed in locations that adversaries routinely search.

Rationale

Credential discovery is the primary mechanism by which adversaries escalate privileges and move laterally. By placing credential breadcrumbs along natural search paths, you create a trail that looks exactly like the sloppy credential hygiene that adversaries expect and exploit in real environments.

Supporting Basis

Direct antecedent

The sources place false credentials where an attacker may discover and attempt to use them.

These sources establish design lineage and scope. They do not validate this record's operational effectiveness, planning estimates, environment labels, or ATT&CK relationships.

Implementation Steps

Map credential search patterns

Document where adversaries typically search for credentials in your environment type: config files, scripts, browser stores, credential managers, environment variables.

Create breadcrumb credentials

Generate credentials that authenticate against deception assets. Make them look like the kind of credentials that get accidentally left in scripts and config files.

Place along natural search paths

Distribute breadcrumbs in locations that adversaries search routinely. A database connection string in an application config file, an SSH key in a home directory, AWS keys in a .env file.

Establish the trail

Ensure that following one breadcrumb leads to a deception asset that contains another breadcrumb, creating a progressive trail deeper into the deception environment.

Technical Implementation Examples(1)

Credential Breadcrumb Trail Script

Plant a chain of credential breadcrumbs that lead from production systems toward deception infrastructure

bash

#!/bin/bash
# credential-breadcrumb-trail.sh
# Creates a trail of discoverable credentials leading from
# production workstations toward deception infrastructure.
#
# Trail: Workstation -> Jump Host Creds -> "DB Server" Creds -> Decoy DB

echo "[*] Laying credential breadcrumb trail..."

# BREADCRUMB 1: On production workstations
# Fake RDP connection history pointing to deception jump host
# (Windows: manually create via reg add or Group Policy)
cat > /tmp/breadcrumb-rdp-history.txt << 'RDPHIST'
# Simulate recent RDP connections in a user's profile
# Target: admin-jump-03.corp.internal (deception host)
# This file should be converted to .rdp and placed in
# the user's Documents or Desktop folder.

full address:s:admin-jump-03.corp.internal
username:s:r.nakamura
domain:s:CORP
RDPHIST

# BREADCRUMB 2: On the deception jump host
# SSH config pointing to "database server" (also deception)
mkdir -p /home/r.nakamura/.ssh
cat > /home/r.nakamura/.ssh/config << 'SSHCFG'
Host prod-db-04
    HostName prod-db-04.corp.internal
    User dba_admin
    IdentityFile ~/.ssh/id_rsa_db
    # Added 2026-01-15 for emergency DB access
SSHCFG

# Generate the referenced SSH key
ssh-keygen -t rsa -b 2048 -f /home/r.nakamura/.ssh/id_rsa_db \
    -N "" -C "dba_admin@prod-db-04" -q

# BREADCRUMB 3: On the deception "jump host"
# Notes file with database credentials (leads to decoy DB)
cat > /home/r.nakamura/Documents/db-access-notes.txt << 'DBNOTES'
Database Access - KEEP SECURE
-----------------------------
Production DB (read-only replica for reporting):
  Host: prod-db-04.corp.internal
  Port: 5432
  User: report_readonly
  Pass: R3p0rt#ReadOnly_2026!
  DB:   customerdb

For emergency write access contact DBA team.
SA credentials are in the team vault.
DBNOTES

chmod 600 /home/r.nakamura/Documents/db-access-notes.txt

echo "[+] Breadcrumb trail laid:"
echo "    1. RDP history -> admin-jump-03 (deception)"
echo "    2. SSH config  -> prod-db-04 (deception)"
echo "    3. Text file   -> DB credentials (trap)"
echo ""
echo "[!] Each hop leads deeper into the deception environment."
echo "[!] Monitor for use of: dba_admin, report_readonly"

MITRE ATT&CK Mappings

Technique	Tactic	Relationship
T1552Unsecured Credentials	Credential Access	detects
T1555Credentials from Password Stores	Credential Access	detects

Considerations

Breadcrumbs should be plausible mistakes, not gifts. A password in a shell history file feels natural. A password in a file named "read_me_first.txt" feels like a trap.
The credential chain should require effort at each step. Instant access to everything feels wrong. A realistic credential trail involves discovering one credential, using it to access a system, and finding another credential there.
Monitor credential usage to verify the trail is working. Credentials that are never used indicate the breadcrumbs are not being found.

Supported Environments

🏢On-Premise

☁Amazon Web Services

☁Microsoft Azure

☁Google Cloud Platform

🔄Hybrid Environment

Tools & Resources

Credential generation scripts
Configuration file templates
Active Directory management

Related Techniques

SDF-DP03Credential Trap Planting

SDF-LR05Lateral Movement Channels

Quick Stats

Phase: Lure
Difficulty: intermediate
Detection Value: high
Cost: minimal
Time: 2-5 days
ATT&CK Mappings: 2