What is a honeyfile?
A honeyfile is a fake document placed where an intruder or a snooping insider would go looking for something valuable. Its name and location are chosen to tempt: passwords.xlsx in an IT share, Q4-layoffs.docx in an HR folder, or merger-term-sheet.pdf in an executive's synced drive. The contents are fake, and nobody has a work reason to open it, so any access to the file is a strong sign that someone is browsing where they shouldn't.
How a honeyfile raises an alert
- File access auditing. On Windows, turn on object access auditing and add an audit entry (a SACL) to the file. Each access attempt then logs event ID 4663, and a SIEM rule turns any event for that path into a high-priority alert.
- A beacon inside the document. The file references a unique URL or hostname, so opening it makes a network request the defenders can see. Beacons stay silent when the file is opened offline or in a viewer that blocks remote content, which is why they are paired with auditing.
- Cloud storage monitoring. Storage services and data security tools can alert on access to a specific file, or on bulk downloads that include it.
A typical rule watches one path and excludes the few accounts that touch it legitimately, such as the backup service:
EventID=4663 AND ObjectName="D:\Shares\IT\Admin\passwords.xlsx" AND SubjectUserName!="svc_backup"
Placing and maintaining honeyfiles
A honeyfile only works where an attacker will look. Good spots are shares that ransomware operators and data thieves enumerate early, synced folders on high-value users' machines, and cloud storage that holds sensitive data. Give each file realistic metadata: a believable author, a modified date that isn't last week, and a size that suits its type. Keep the list of honeyfiles inside the security team, and open each one on a schedule to prove the alert still fires, since a changed audit policy or a broken log forwarder can silence it. Some endpoint protection products apply the same idea automatically, planting hidden decoy files and treating any process that encrypts them as ransomware.
Handling a honeyfile alert
The event names the account, and the matching network logon or share access event gives the source address of the machine to investigate first. If the account belongs to an employee, the alert may reflect insider activity, so HR and legal procedures run alongside the security response and the evidence is preserved with chain of custody. If it is a service or admin account acting out of character, assume compromise and contain the host.
Honeyfile vs. honeytoken and DLP
- Honeyfile: a decoy document; it mainly catches someone browsing or collecting files.
- Honeytoken: any fake data, such as a key, record or hostname, that alerts when it is used anywhere, even after leaving the network. A beacon embedded in a honeyfile is a kind of honeytoken.
- DLP: watches real sensitive data as it moves; a honeyfile holds nothing real.
Honeyfile on the CompTIA Security+ exam
Honeyfiles are deception and disruption technology under SY0-801 objective 4.1. A scenario about a fake document with an enticing name, an alert when a file nobody uses is opened, or catching an insider who browses HR or finance shares points to a honeyfile. Decide by what was planted: a document is a honeyfile, data such as a credential or key is a honeytoken, and a system is a honeypot. DLP and file integrity monitoring are the common distractors. DLP watches real data leaving, and file integrity monitoring alerts when protected files change, not when a decoy is read.