Decoy File Access Detection

Aaron Beardslee@abeardslee

•updated Feb 2, 2026•0•34

Detects unauthorized access to decoy files (canary files) placed in strategic locations. By monitoring for access to files with enticing names (e.g., 'passwords.xlsx'), organizations can identify file discovery and data staging activities. Any access to these files is highly suspicious as they have no legitimate purpose. Walkthrough for the creation of Canary Files can be found here: https://github.com/fluffybunnies-h4x/CyberDeception?tab=readme-ov-file#canary-files