Mapping Honeypot Detections to MITRE ATT&CK

When your honeypot catches an attacker probing a fake API endpoint, what do you tell your SOC? “We detected something bad” does not cut it anymore. Security teams need context. They need to understand where the attack fits in the threat landscape, how it relates to other alerts, and what the adversary might do next.

That is where MITRE ATT&CK comes in. By mapping honeypot detections to ATT&CK tactics, you turn isolated alerts into events that speak the same language as the rest of your security stack.

This guide explains how honeypot behaviors map to the MITRE ATT&CK framework in general, exactly what WebDecoy attaches to each detection, and how to use that mapping in your security operations.

Why MITRE ATT&CK Mapping Matters for Deception Technology

Deception technology produces unusually high-fidelity alerts. Legitimate users rarely stumble onto fake endpoints or invisible trap links, so an interaction with a decoy is strong evidence of automated or adversarial activity.

But high fidelity alone is not enough. Your honeypot alerts need to sit alongside endpoint detections, network alerts, and identity events, and feed your reporting.

MITRE ATT&CK provides the common language that makes this integration possible.

Consider what happens without ATT&CK mapping:

• Your honeypot detects activity against a fake login endpoint
• The alert gives a source IP and a score
• Your SOC analyst has to work out the attack category by hand
• Nothing lines it up with other ATT&CK-tagged events in your SIEM

With a tactic attached:

• The alert is labeled Credential Access (TA0006)
• Analysts know immediately what phase of an attack they are looking at
• It can be grouped with other Credential Access events from your identity provider or EDR
• Coverage reporting can count it against the framework

What Is MITRE ATT&CK: Essential Context

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a globally accessible knowledge base of adversary behavior. It categorizes attack activities into:

Tactics: The adversary’s tactical objectives (the “why”). Examples include Reconnaissance, Initial Access, Credential Access, and Collection.

Techniques: How adversaries achieve those objectives (the “how”). Each tactic contains multiple techniques. For example, Credential Access includes Brute Force, OS Credential Dumping, and Input Capture.

Sub-techniques: Granular variations of techniques. Brute Force (T1110) has sub-techniques like Password Guessing (T1110.001), Password Spraying (T1110.003), and Credential Stuffing (T1110.004).

Procedures: Specific implementations by threat actors. These provide real-world examples of how particular groups execute techniques.

For deception technology, ATT&CK mapping tells you where a honeypot detection sits in the adversary lifecycle. An attacker crawling your site looking for hidden endpoints is performing Reconnaissance. The same attacker trying passwords against a decoy login is after Credential Access.

What WebDecoy Attaches to a Detection

Every WebDecoy detection carries one MITRE ATT&CK tactic, with a confidence level (high, medium, or low), shown on the detection and returned by the API as part of the detection’s detail. It is chosen in this order:

1. A tactic supplied by the sensor. For example, the WordPress plugin reports the tactic for what it observed.
2. The decoy path. A request for /wp-login.php or /.env says more than the decoy’s type does, so the path is used to infer the tactic when it is available.
3. The decoy type. Each decoy type has a primary tactic.
4. A generic fallback of Reconnaissance, for example for Bot Scanner detections that did not involve a decoy.

The decoy-type defaults:

WebDecoy does not assign technique or sub-technique IDs per detection. The tactic answers “what phase is this,” and the tables below are a guide for your own analysts when they want to go one level deeper.

How Honeypot Behaviors Map to ATT&CK

The rest of this section is general ATT&CK guidance: the tactics and techniques that the behaviors a web honeypot sees correspond to. Use it to reason about a detection, write your own correlation rules, or plan decoy coverage.

Behavioral (Bot Scanner) signals

Bot Scanner adds a detection layer that catches automation before it touches any decoy, by looking at browser-side signals such as headless browser characteristics, automation framework artifacts, and interaction patterns. In ATT&CK terms, automated browsing of your site is mostly reconnaissance:

Decoy interactions

Tactic-by-Tactic Breakdown

Reconnaissance (TA0043)

Reconnaissance is the adversary’s information-gathering phase. They are mapping your attack surface, identifying technologies, and looking for entry points. Honeypots excel here because legitimate users never interact with hidden decoys.

Invisible decoy links (hidden via CSS or placed in low-visibility locations) are found only by automated crawlers and people reading your source. A hit indicates:

• Active Scanning (T1595): Automated scanners probing for hidden endpoints
• Search Victim-Owned Websites (T1594): Manual or automated enumeration of your web properties
• Gather Victim Host Information (T1592): Bots and scrapers collecting data about your infrastructure

Fake API endpoints catch active reconnaissance against your API surface:

• Active Scanning: Vulnerability Scanning (T1595.002): Automated tools probing for exploitable endpoints
• Active Scanning: Wordlist Scanning (T1595.003): Attackers using common path wordlists to enumerate APIs

Resource Development (TA0042)

Resource Development involves adversaries acquiring or building infrastructure to support attacks. It is hard to observe directly, but some honeypot interactions hint at it:

• Attackers testing tooling against decoys before targeting real assets
• Validation of proxy networks and VPN configurations
• Testing credential lists against honeypot login endpoints

Traffic from hosting providers or proxy networks that looks like tooling tests is where this tactic shows up.

Initial Access (TA0001) and Credential Access (TA0006)

Credential Access is attempting to steal or guess credentials. Decoy login endpoints give direct visibility into brute force variants:

If an attacker who hit your decoy login later authenticates successfully against a real account, that success is Valid Accounts (T1078), which ATT&CK files under Initial Access among others. That transition is exactly what correlating decoy detections with your identity logs is for.

Execution (TA0002)

Execution tactics involve running adversary-controlled code. Decoy endpoints that accept input see injection payloads: command injection attempts map to Command and Scripting Interpreter (T1059), and exploitation attempts against a service to techniques like Exploitation for Client Execution (T1203) or Exploitation of Remote Services (T1210), depending on the target.

Discovery (TA0007)

Discovery involves adversaries exploring your environment to understand what they can access. Honeypots see this when attackers enumerate decoy endpoints:

• File and Directory Discovery (T1083): Path traversal and directory probing
• Software Discovery (T1518): GraphQL introspection queries mapping your schema
• Account Discovery (T1087): Probing user and admin endpoints to enumerate accounts

Collection (TA0009)

Collection tactics involve gathering data of interest. Decoys positioned at export, backup, or data-access paths catch:

• Data from Information Repositories (T1213)
• Automated Collection (T1119): scrapers harvesting content at scale

Getting the Tactic Into Your SIEM

WebDecoy forwards detections to Splunk, CrowdStrike Falcon LogScale, Datadog, and signed webhooks (see the SIEM integration guide). Those forwarded events are compact: they carry the detection ID, IP, scores, threat level, and category, but not the MITRE tactic.

To get the tactic into your SIEM, enrich in your pipeline: take the detection_id from the forwarded event and fetch the full detection from the WebDecoy API (GET /organizations/{org}/detections/{id}), which includes the MITRE mapping. A webhook receiver that does this lookup before indexing is the simplest way to do it.

Benefits of ATT&CK Mapping for Security Operations

Unified Threat Language with SOC Teams

When a honeypot detection says “Credential Access,” every analyst immediately understands the phase of the attack. The same terminology appears in your SIEM, EDR, threat intelligence feeds, and incident reports.

That shared vocabulary helps with:

• Triage speed: Analysts recognize the attack phase at a glance
• Escalation decisions: A Credential Access or Collection hit usually matters more than Reconnaissance
• Communication: Consistent terminology across teams and tools

Better SIEM Correlation

Once the tactic is in your SIEM, correlate by source IP across data sources. A useful pattern: the same IP showing up in WebDecoy Reconnaissance or Credential Access detections, then in a successful login in your identity provider logs. That sequence is a strong candidate for a compromised account.

Compliance and Reporting

Security frameworks increasingly ask you to demonstrate detection coverage. Tactic-labeled detections let you:

• Report coverage: show which ATT&CK tactics your deception layer observes
• Find gaps: identify tactics no decoy covers and plan additional decoys
• Provide evidence: give auditors framework-aligned detection logs

Threat Intelligence Enrichment

Tactic-labeled detections are easier to use in threat intelligence work: exporting IOCs with context to a TIP such as MISP or OpenCTI, comparing against known actor behavior, and tracking which phases adversaries reach against your organization over time.

Implementing ATT&CK-Aligned Deception

Strategic Decoy Placement by Tactic

Place decoys to cover the tactics you care about:

Reconnaissance coverage:

• Hidden links, robots.txt entries, and hidden forms
• Fake API documentation or admin paths

Credential Access coverage:

• Fake login endpoints at predictable paths (/api/auth/login, /admin/signin)
• Config file decoys (/.env, /config.php.bak)

Discovery coverage:

• Debug endpoints
• Admin panels with enumerable user lists

Collection coverage:

• Backup file decoys (/backup.zip, /db.sql)
• Export endpoints

Continuous Coverage Improvement

1. List the tactics your current decoys cover (an ATT&CK Navigator layer you maintain yourself is a good way to visualize it)
2. Identify uncovered tactics relevant to your threat model
3. Deploy additional decoys targeting those tactics
4. Validate detection by simulating the behavior against your decoys
5. Update your coverage map and iterate

Key Takeaways

MITRE ATT&CK mapping turns honeypot detections from isolated alerts into events your SOC already has a vocabulary for. WebDecoy labels every detection with one ATT&CK tactic, which gives you:

• Immediate analyst understanding of the attack phase
• SIEM correlation once the tactic is enriched into your events
• Coverage reporting aligned to the framework

The technique tables above are there for your analysts to go deeper when a detection warrants it.

Ready to add ATT&CK-labeled deception to your security stack? Start free with WebDecoy and see the tactic on every detection.

Need help designing ATT&CK-aligned decoy deployments? Contact us.