domains / families / security / deploying-active-directory-honeytokens

deploying-active-directory-honeytokens

separate

'Deploys deception-based honeytokens in Active Directory including fake

When to use

• When deploying deception-based detection in Active Directory environments
• When detecting Kerberoasting attacks via fake SPN honeytokens (honeyroasting)
• When creating tripwire accounts to detect credential theft and lateral movement
• When building decoy GPOs to detect Group Policy Preference password harvesting
• When creating deceptive BloodHound paths to misdirect and detect attackers
• When supplementing existing AD monitoring with high-fidelity detection signals

Skill page

Source