When deploying deception-based detection in Active Directory environments
When detecting Kerberoasting attacks via fake SPN honeytokens (honeyroasting)
When creating tripwire accounts to detect credential theft and lateral movement
When building decoy GPOs to detect Group Policy Preference password harvesting
When creating deceptive BloodHound paths to misdirect and detect attackers
When supplementing existing AD monitoring with high-fidelity detection signals
Prerequisites
Domain Admin or delegated AD administration privileges
Active Directory domain (Windows Server 2016+ recommended)
Windows Event Log forwarding to SIEM (Splunk, Sentinel, Elastic)
PowerShell 5.1+ with ActiveDirectory module
Group Policy Management Console (GPMC)
Understanding of AD security, Kerberos, and BloodHound attack paths
Background
Why AD Honeytokens
Traditional signature-based detection misses novel attack techniques. Honeytokens
provide high-fidelity detection with near-zero false positives because any interaction
with a decoy object is inherently suspicious. In Active Directory:
**Fake privileged account…
以下为摘要预览，完整内容请查看 GitHub 原文。
Deploying Active Directory Honeytokens
When to Use
When deploying deception-based detection in Active Directory environments
When detecting Kerberoasting attacks via fake SPN honeytokens (honeyroasting)
When creating tripwire accounts to detect credential theft and lateral movement
When building decoy GPOs to detect Group Policy Preference password harvesting
When creating deceptive BloodHound paths to misdirect and detect attackers
When supplementing existing AD monitoring with high-fidelity detection signals
Prerequisites
Domain Admin or delegated AD administration privileges
Active Directory domain (Windows Server 2016+ recommended)
Windows Event Log forwarding to SIEM (Splunk, Sentinel, Elastic)
PowerShell 5.1+ with ActiveDirectory module
Group Policy Management Console (GPMC)
Understanding of AD security, Kerberos, and BloodHound attack paths
Background
Why AD Honeytokens
Traditional signature-based detection misses novel attack techniques. Honeytokens
provide high-fidelity detection with near-zero false positives because any interaction
with a decoy object is inherently suspicious. In Active Directory:
