The Honey File has been triggered!

⚠️ Configure Detection Rule - How To Guide

Note about Alert

This detection rule needs to be configured manually. Please visit rules.cybersift.io to generate your honey file detection rule.

Requirements:

  • Ensure correct auditing of your files - Setup Audit Object Policy

  • Create the honey file and take note of the name

  • Add real looking fake data in the honey file.

  • Take note of the hostname of the server

  1. Go to rules.cybersift.io

  2. Click on Generate Honey File



  3. Fill out the required information (Please ensure that the hostname matches the agent.hostname field produced in the SIEM



  4. Create the detection rule


Trigger: Identification of a Windows Security Log Event ID 4663 (An attempt was made to access an object) where a process or account attempts to access a configured decoy file with ReadData permissions.

Severity: 🟣Critical

Context: Honey files act as active defense decoys placed in high-value directories to detect unauthorized file enumeration, insider threats, or ransomware operations. Because these files serve no operational purpose, any attempt to read or open them directly indicates malicious or unauthorized discovery activity.

MITRE ATT&CK:

  • Reconnaissance (TA0043)

  • Active Scanning (T1595)

  • Collection (TA0009)

  • Data from Local System (T1005)

Investigation Steps 🔎

1. Confirm the activity

  • Inspect the host identifier (agent.hostname) and confirm the specific object name (winlog.event_data.ObjectName) matches the deployed honey file path.

  • Retrieve the accessing user context (winlog.event_data.SubjectUserName) and unique security identifier (SID) to identify the account involved.

  • Cross-reference process creation telemetry (4688) around the same timestamp to extract the responsible process name (winlog.event_data.ProcessName), Process ID, and parent process lineage.

2. Verify Authorization

  • Check if the active defense team, authorized red-team vendors, or penetration testers are conducting scheduled security testing or decoy validation.

  • Confirm whether automated system utilities, backup agents, or antivirus indexers inadvertently touched the path during routine file system scans.

  • Contact the account holder through an out-of-band communication channel to verify if the file access was intentional or driven by an automated local script.

3. Assess Risk

  • Review adjacent host process telemetry for indicators of automated ransomware enumeration, discovery tools, or mass directory traversing.

  • Inspect file system logs for subsequent high-volume read, modification, or encryption events occurring across surrounding sensitive file paths.

  • If the access is unapproved, isolate the host from the network immediately, terminate associated user sessions, and initiate incident containment protocols.