CISA Urges Organizations to Deploy Cyber Decoys as Low‑Cost Defense Against Living‑Off‑the‑Land Attacks

CISA has published new guidance encouraging organizations to deploy cyber decoys, honeytokens, and tripwires as a practical way to detect intruders who rely on legitimate credentials and living-off-the-land techniques to evade traditional security controls.

The document, titled "Using Cyber Decoys to Strengthen Detection and Response," argues that many organizations struggle to identify adversaries who blend in with normal activity by using built-in administrative tools and valid accounts. CISA says that once defenders accept that intruders will eventually gain a foothold, the most effective strategy is to seed the environment with fake systems, services, files, and credentials that no legitimate user would ever touch.

Any interaction with these decoys acts as a tripwire, alerting defenders to malicious activity and providing opportunities to gather intelligence. CISA says decoys can also impose cost on adversaries, disrupt their operations, and reduce the value of their actions.

One of the guidance's central messages is that cyber deception does not require major architectural changes or new spending. CISA instructs organizations to repurpose tools they already own — such as EDR platforms, identity and access management systems, and data loss prevention tools — to deploy and monitor decoys. Open-source solutions for token generation and alerting are recommended for teams with limited budgets, while organizations with more resources can use commercial platforms or build custom honeytokens tailored to their environment.

The guidance explains the different types of decoys: honeytokens (files, records, secrets, credentials) and honeypots (systems, services) act as the traps, breadcrumbs steer attackers toward them, and tripwires describe any decoy rigged to alert on interaction. CISA organizes tactics around MITRE Engage's three goals: Expose adversaries, Affect them by imposing cost, and Elicit intelligence by safely observing their behavior.

For teams getting started, CISA offers concrete examples: planting fake admin-only credentials, placing decoy folders on executive desktops, deploying honeytokens such as a bogus "Project_Metrics.xlsx" file on a monitored share, or alerting on PowerShell execution on workstations where ordinary users have no legitimate need for it. The "Elicit" goal, which involves drawing adversaries into controlled environments, requires isolated infrastructure, mature logging, and skilled personnel, and is positioned as a later-stage capability.

Effective tripwires should be threat-informed, distinct from normal behavior, detectable by existing monitoring tools, and tied to clear response procedures. The guidance leans heavily on MITRE ATT&CK to help organizations map vulnerabilities, existing detections, and likely adversary techniques, then place decoys where coverage gaps are greatest.

A worked scenario in the document walks through how a medium-sized water and wastewater organization uses ATT&CK and Engage together to prioritize assets, design its decoy operation, and refine it through threat emulation, red teaming, or purple teaming.

CISA also stresses that decoys must be carefully designed so attackers cannot exploit them to reach real systems or privileges. Documentation describing decoy locations should be stored outside the production environment in case the network is compromised.

"CISA encourages critical infrastructure organizations to review this guide and implement a cyber decoy strategy," said Acting Executive Assistant Director for Cybersecurity Chris Butera.