What problem does it solve?
Signature-based detection often misses novel Active Directory attacks like Kerberoasting, credential theft, and BloodHound-driven reconnaissance. This Skill deploys deception-based honeytokens that generate high-fidelity, near-zero-false-positive alerts whenever an attacker interacts with decoy AD objects.
Core Features & Use Cases
- Fake Privileged Accounts: Creates aged, realistic decoy admin accounts with AdminCount=1 to detect credential dumping and lateral movement.
- Honeyroasting SPNs: Registers fake Service Principal Names so any Kerberos TGS request (Event ID 4769) against them is definitively malicious.
- Decoy GPOs & BloodHound Paths: Plants cpassword traps in SYSVOL and fake ACL attack paths to detect GPP password harvesting and mislead graph-based reconnaissance.
- SIEM Detection Rules: Generates Splunk SPL, Microsoft Sentinel KQL, and Sigma rules monitoring Event IDs 4769, 4625, 4662, and 5136.
- Use Case: A blue team wants early warning of Kerberoasting in their domain. They deploy a honeytoken service account with a fake MSSQLSvc SPN, then alert on any TGS request for it, catching attackers during reconnaissance before any real damage occurs.
Quick Start
Deploy a full Active Directory honeytoken suite with fake admin accounts, SPNs, and decoy GPOs, then generate Splunk detection rules for my domain corp.example.com.
