In cyber deception, a "honey user" (or "honey account") is a decoy user account designed to detect and monitor malicious activities. These accounts attract attackers by appearing legitimate or using common account names, but any interaction with them is highly suspicious and flagged for investigation. Honey users can be deployed in various forms, such as Active Directory users, local system accounts, web application users, and cloud users.

Sections

ID	Name	Description
PR027.002	Impersonation via Collaboration and Communication Tools	The subject creates, modifies, or misuses digital identities within internal communication or collaboration environments—such as email, chat platforms (e.g., Slack, Microsoft Teams), or shared document spaces—to impersonate trusted individuals or roles. This tactic is used to gain access, issue instructions, extract sensitive data, or manipulate workflows under the guise of legitimacy. Impersonation in this context can be achieved through: Lookalike email addresses (e.g., spoofed domains or typo squatting). Cloned display names in collaboration tools. Shared calendar invites or chats initiated under false authority. Use of compromised or unused accounts from real employees, contractors, or vendors. The impersonation may be part of early-stage insider coordination, privilege escalation attempts, or subtle reconnaissance designed to map workflows, bypass controls, or test detection thresholds. Example Scenarios: A subject registers a secondary internal email alias (`john.smyth@corp-secure.com`) closely resembling a senior executive and uses it to request financial data from junior employees. A subject joins a sensitive Slack channel using a display name that mimics another department member and quietly monitors ongoing discussions related to mergers and acquisitions activity. A compromised service account is used by an insider to initiate SharePoint document shares with external parties, appearing as a legitimate internal action. The subject impersonates an IT support contact via Teams or email to socially engineer MFA tokens or password resets.

References