๐ Secure Bits ๐ก
๐ช๐ฎ๐ป๐ ๐๐ผ ๐ฑ๐ฒ๐๐ฒ๐ฐ๐ ๐บ๐ฎ๐น๐ถ๐ฐ๐ถ๐ผ๐๐ ๐๐ ๐ฒ๐ป๐๐บ๐ฒ๐ฟ๐ฎ๐๐ถ๐ผ๐ป ๐ฏ๐ฒ๐ณ๐ผ๐ฟ๐ฒ ๐ฟ๐ฒ๐ฎ๐น ๐ฑ๐ฎ๐บ๐ฎ๐ด๐ฒ ๐ต๐ฎ๐ฝ๐ฝ๐ฒ๐ป๐?
๐ชคย ๐๐ฐ๐๐ถ๐๐ฒ ๐๐ถ๐ฟ๐ฒ๐ฐ๐๐ผ๐ฟ๐ ๐๐ผ๐ป๐ฒ๐๐ฝ๐ผ๐ย โ Simple Detection for Enumeration
In this short guide, I show you how to set up aย Canary Userย in AD โ combined with auditing and a deny DACL โ to catch attackersย during the reconnaissance phase. Itโs a lightweight honeypot tactic anyone can deploy.
๐ ๐ฌ๐ผ๐โ๐น๐น ๐น๐ฒ๐ฎ๐ฟ๐ป ๐ต๐ผ๐ ๐๐ผ:
โช๏ธ Create the honeypot account
โช๏ธ Set SACLs and DACLs
โช๏ธ Enable proper audit policies
โช๏ธ Test it with SharpHound
Great for internal detection, test labs, or as part of your AD monitoring toolkit.
Full PDF guide is here: Active Directory – Honeypot
๐ฃ๐ฆ: You can easily hide the honeypot account if you wish. I cover hiding techniques in my other posts.
โฌ๏ธย ๐๐ต๐ฒ๐ฐ๐ธ ๐ผ๐๐ ๐ฎ๐น๐น ๐บ๐ ๐ด๐๐ถ๐ฑ๐ฒ๐ ๐ฟ๐ฒ๐น๐ฎ๐๐ฒ๐ฑ ๐๐ผ ๐๐ถ๐บ๐ถ๐น๐ฎ๐ฟ ๐๐ผ๐ฝ๐ถ๐ฐ๐:
Windows Infrastructure Security Guides | Horizon Secured – Academy
This creation was also inspired by An ACE Up the Sleeve by Andy Robbins and Will Schroeder. Their presentation is available online on the Black Hat website.