CISA Cyber Decoy Guidance 2026: Deploying Deception to Detect LOTL and Credential-Based Intrusions

The hardest intrusions to catch in 2026 are not the ones that drop malware. They are the ones that log in. Adversaries — from ransomware affiliates to state-sponsored operators — are increasingly conducting discovery, lateral movement, and data access using legitimate credentials, native tools, and living-off-the-land (LOTL) techniques that blend into normal administrative noise. Signature-based detection and even well-tuned behavioral analytics struggle here, because the activity is, by design, indistinguishable from what your sysadmins do every day.

CISA's newly published guidance, Using Cyber Decoys to Strengthen Detection and Response, directly addresses this detection gap. The guidance is written for defensive teams at varying maturity levels and lays out how to plan and implement cyber decoy strategies — assets that appear to be legitimate systems, accounts, or data, but exist solely to distract adversaries, detect their presence, or facilitate collection of cyber threat intelligence (CTI). Critically, CISA frames decoys as a natural complement to Zero Trust architecture: assume the adversary will gain some level of access, and instrument your environment so that the moment they touch anything they shouldn't, you know.

This is a fundamental shift in detection philosophy. Instead of trying to prove activity is malicious, you create assets where any interaction is malicious by definition. That inversion produces the highest-fidelity alerts a SOC can own.

Technical Analysis

What CISA's Guidance Covers

CISA's guidance is not a product endorsement or a compliance mandate — it is an implementation framework built around three decoy functions:

1. Distract — Decoys present attractive, fake targets that consume adversary time and effort, steering them away from real production assets.
2. Detect — Because no legitimate user or process has any business reason to touch a decoy, any interaction is a near-zero-false-positive indicator of unauthorized activity.
3. Collect — Decoys act as sensors that capture adversary TTPs, tooling, and infrastructure, feeding directly into CTI production.

Why This Matters: The LOTL Detection Problem

The specific threat pattern CISA calls out is the modern intrusion playbook:

• Valid account abuse (MITRE ATT&CK T1078) — Stolen or brute-forced credentials used for initial access and persistence. Traditional controls see a successful logon, not an attack.
• LOTL discovery (T1033, T1087, T1082, T1135) — net.exe, nltest, dsquery, PowerShell AD cmdlets, and built-in WMI used to enumerate users, groups, shares, and systems. Every one of these commands also runs thousands of times a day in a normal environment.
• Lateral movement via native protocols (T1021) — RDP, SMB, WinRM, and SSH using legitimate credentials. Network devices see authenticated, encrypted, expected traffic.

Decoys cut through this ambiguity. A canary service account with an intentionally weak-looking SPN, a decoy file share labeled Finance-Backups, a fake domain admin credential cached in memory on a workstation — none of these have any legitimate consumer. When an adversary enumerating the domain touches one, you get a deterministic signal instead of a probabilistic one.

Decoy Classes Mapped to ATT&CK

Exploitation Status

This is a defensive guidance publication, not a vulnerability disclosure — there is no associated CVE or KEV entry. The relevance, however, is driven by confirmed, ongoing threat activity: credential-based initial access and LOTL tradecraft remain the dominant intrusion pattern across ransomware, espionage, and supply-chain compromises tracked throughout 2025 and into 2026. CISA explicitly positions decoys within a Zero Trust assume-breach posture: you plan for the adversary already having a foothold and instrument accordingly.

Detection & Response

Decoys are only as valuable as the alerting wired to them. The rules below implement the core detection patterns CISA's guidance implies: any authentication to a canary account, any network touch of a decoy asset, and Kerberoasting-style requests against a canary service account. Tune the placeholder values (account names, decoy IPs) to your own deception deployment — and keep those values out of any document an adversary might read.

Sigma Rules

---
title: Authentication Attempt to Canary or Deception Account
id: 3f8c2a91-7d4e-4b6a-9c21-5e8f0a1b2c3d
status: experimental
description: Detects any interactive or network logon to a designated canary/deception account. These accounts have no legitimate use, so any authentication is high-fidelity evidence of credential theft or unauthorized access.
references:
  - https://www.cisa.gov/resources-tools/resources/using-cyber-decoys-strengthen-detection-and-response
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.defense_evasion
  - attack.persistence
  - attack.t1078
logsource:
  product: windows
  service: security
detection:
  selection:
    TargetUserName:
      - 'svc_backup'
      - 'adm_jwalker'
      - 'sql_reports'
      - 'helpdesk_temp'
  condition: selection
falsepositives:
  - Accidental typos by legitimate users (investigate, but rare)
  - Vulnerability scanners using harvested credential lists
level: critical
---
title: Kerberos Service Ticket Request for Canary Service Account
id: 6b1d4e72-9a3f-4c58-b7e2-2d9c0f4a5e6b
status: experimental
description: Detects Kerberos TGS requests for a canary service account with a deliberately attractive SPN. Canary service accounts exist only to catch Kerberoasting; any TGS request against them indicates credential harvesting activity.
references:
  - https://www.cisa.gov/resources-tools/resources/using-cyber-decoys-strengthen-detection-and-response
  - https://attack.mitre.org/techniques/T1558/003/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.credential_access
  - attack.t1558.003
logsource:
  product: windows
  service: security
detection:
  selection:
    ServiceName:
      - 'svc_backup'
      - 'MSSQLSvc/fakesql.corp.local'
  filter_legit:
    AccountName|endswith: '$'
  condition: selection and not filter_legit
falsepositives:
  - None expected; canary service accounts must never be requested legitimately
level: critical
---
title: Network Connection to Decoy Host or Listener
id: 8c5e1f34-2b7d-4a96-cd38-4f1a6b8c9d0e
status: experimental
description: Detects network connections from production endpoints to decoy hosts or honeypot listeners. Decoy assets have no legitimate consumers, so any connection attempt signals discovery scanning or lateral movement.
references:
  - https://www.cisa.gov/resources-tools/resources/using-cyber-decoys-strengthen-detection-and-response
  - https://attack.mitre.org/techniques/T1046/
  - https://attack.mitre.org/techniques/T1021/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.discovery
  - attack.lateral_movement
  - attack.t1046
  - attack.t1021
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationIp:
      - '10.90.0.15'
      - '10.90.0.16'
    DestinationPort:
      - 445
      - 3389
      - 5985
      - 22
  condition: selection
falsepositives:
  - Misconfigured legacy applications with hardcoded IPs (fix the app, keep the rule)
  - Authorized vulnerability scanners (exclude scanner service accounts/subnets)
level: high

KQL — Microsoft Sentinel / Defender

// Hunt 1: Any authentication to canary/deception accounts (last 14 days)
// Replace the account list with your deployed canary identities
let CanaryAccounts = dynamic(["svc_backup", "adm_jwalker", "sql_reports", "helpdesk_temp"]);
SecurityEvent
| where TimeGenerated > ago(14d)
| where EventID in (4624, 4625, 4768, 4776)
| where TargetUserName in~ (CanaryAccounts)
| project TimeGenerated, EventID, TargetUserName, IpAddress, WorkstationName,
          LogonType, Status, SubStatus, Account
| order by TimeGenerated desc;

// Hunt 2: Connections to decoy hosts from any production endpoint
// Replace with your decoy IP space; enrich with process context for triage
let DecoyHosts = dynamic(["10.90.0.15", "10.90.0.16"]);
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteIP in~ (DecoyHosts)
| project TimeGenerated, DeviceName, LocalIP, RemoteIP, RemotePort,
          InitiatingProcessAccountName, InitiatingProcessFileName,
          InitiatingProcessCommandLine
| order by TimeGenerated desc;

// Hunt 3: Syslog/CEF-ingested honeypot hits (for network decoys reporting to Sentinel)
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DeviceVendor =~ "Deception" or DeviceProduct has_any ("honeypot", "decoy")
| summarize HitCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
  by SourceIP, DestinationIP, DestinationPort, Activity
| order by HitCount desc;

Velociraptor VQL

-- Hunt endpoints for connections to decoy assets and evidence of
-- canary credential usage in memory-adjacent artifacts
SELECT Pid, Name, Path, Family, Protocol,
       LocalAddress.IP AS LocalIP, LocalAddress.Port AS LocalPort,
       RemoteAddress.IP AS RemoteIP, RemoteAddress.Port AS RemotePort,
       Status
FROM netstat()
WHERE RemoteIP =~ '10\.90\.0\.'   -- decoy subnet
   OR RemotePort in (3389, 445, 5985) AND Status =~ 'ESTAB'
      AND RemoteIP =~ '10\.90\.0\.'

Remediation / Deployment Script

The following PowerShell creates a canary service account for Kerberoasting detection, plants decoy credentials, and validates that auditing will catch any touch. Run from a domain-joined management host with appropriate rights. Customize names and SPNs for your environment — and never reuse the examples verbatim in production.

# ============================================================
# Cyber Decoy Deployment & Validation — per CISA guidance
# https://www.cisa.gov/resources-tools/resources/using-cyber-decoys-strengthen-detection-and-response
# ============================================================

# --- 1. Create a canary service account (Kerberoasting tripwire) ---
$CanaryName = "svc_backup"
$CanaryPass = ConvertTo-SecureString (New-Guid).Guid.ToString() + "!x9" -AsPlainText -Force
New-ADUser -Name $CanaryName `
    -SamAccountName $CanaryName `
    -Description "Legacy backup service - DO NOT DISABLE (audit ref 2024-118)" `
    -AccountPassword $CanaryPass `
    -Enabled $true `
    -PasswordNeverExpires $true `
    -CannotChangePassword $true `
    -Path "OU=Service Accounts,DC=corp,DC=local"
# Attractive SPN is the bait — never assign it a real service
Set-ADUser -Identity $CanaryName -ServicePrincipalNames @{Add="MSSQLSvc/fakesql.corp.local:1433"}

# --- 2. Create a decoy 'privileged' user that no one should ever log on as ---
$DecoyAdmin = "adm_jwalker"
New-ADUser -Name $DecoyAdmin `
    -SamAccountName $DecoyAdmin `
    -Description "Domain admin (legacy)" `
    -AccountPassword (ConvertTo-SecureString (New-Guid).Guid.ToString() + "!x9" -AsPlainText -Force) `
    -Enabled $true `
    -Path "OU=Admins,DC=corp,DC=local"
Add-ADGroupMember -Identity "Domain Admins" -Members $DecoyAdmin

# --- 3. Audit configuration: ensure the right events are being generated ---
# Verify Kerberos service ticket auditing (Event 4769) and logon auditing (4624/4625)
auditpol /get /subcategory:"Kerberos Service Ticket Operations"
auditpol /get /subcategory:"Logon"
# Enable if not already (run on all DCs)
auditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:enable /failure:enable
auditpol /set /subcategory:"Logon" /success:enable /failure:enable

# --- 4. Plant a decoy credential in Credential Manager on monitored endpoints ---
# Adversaries dumping cached creds will find and use these — any use = confirmed compromise
cmdkey /add:decoy-srv01.corp.local /user:adm_jwalker /pass:"Sup3rBackup!2026"

# --- 5. Verify: confirm the canary accounts have zero legitimate logon history ---
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} -MaxEvents 5000 |
    Where-Object { $_.Message -match 'svc_backup|adm_jwalker' } |
    Select-Object TimeCreated, Message -First 10
# Expected result: EMPTY. Any hit after deployment is an incident.

Remediation & Implementation Roadmap

CISA's guidance is maturity-scaled — you do not need a commercial deception platform to start. Follow this phased approach:

1. Start with identity decoys (week 1–2). Canary service accounts with attractive SPNs and decoy privileged users cost nothing and produce the highest-fidelity Kerberoasting and credential-abuse detection available. Wire them to your SIEM with the rules above.
2. Plant decoy credentials (week 2–4). Seed honeytokens in Credential Manager, unattend files, scripts, and config repositories on endpoints and jump boxes. Pair with LSASS-access monitoring so you catch the dump and the use.
3. Deploy decoy data and shares (month 2). Fake file shares with enticing names (Finance-Backups, PasswordExport) containing beaconing documents. Alert on any read access; document beacons catch exfiltration even when the data leaves your network.
4. Add decoy hosts/listeners (month 2–3). Low-interaction honeypots answering on SMB/RDP/SSH in production VLANs catch network discovery scanning (T1046) that is otherwise invisible. Ensure they report to your SIEM via Syslog/CEF.
5. Govern the program. Document every decoy in a restricted-access registry (IR and SOC leads only), exclude decoys from vulnerability scanner credential sweeps selectively (scanner hits on decoys are actually useful validation), and review quarterly. Stale decoys that blend into real asset inventories become attack surface, not sensors.
6. Integrate with IR playbooks. A decoy alert is not a tuning candidate — it is a confirmed incident trigger. Pre-stage the response: isolate the source host, reset any credentials that touched the decoy, and scope for the discovery/lateral movement that preceded the touch.
7. Feed CTI. Per CISA's guidance, use decoy interactions to collect adversary TTPs — source infrastructure, tooling, timing — and share through your ISAC or CISA's reporting channels.

No vendor patches apply; the official resource is CISA's guidance itself: https://www.cisa.gov/resources-tools/resources/using-cyber-decoys-strengthen-detection-and-response

Executive Takeaways

• Assume breach, instrument accordingly. Decoys operationalize Zero Trust's core assumption — that an adversary may already be inside — by turning that presence into an immediate, high-fidelity detection event.
• Decoys solve the LOTL problem. When attackers use legitimate credentials and native tools, probabilistic detection fails. Decoys flip the model: any touch is malicious by definition, producing near-zero false positives.
• Start free, scale deliberately. Canary accounts and planted credentials require no budget — only AD access, audit policy, and SIEM rules. Commercial deception platforms are an optimization, not a prerequisite.
• Treat decoy alerts as incidents, not anomalies. The entire value of deception collapses if decoy alerts get triaged like everything else. They deserve your fastest escalation path.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub