Active › Module 8 › Lesson 3
Honeytokens Named
Honeytokens and deception literacy for AD — fake creds, canary SPNs, honeypot accounts; detection not entrapment on strangers.
Visual · t25_honeytokens_named
Honeytokens = named deception for detection. $LAB_AD only. Original Cyberlium.
Opening
A honeytoken screams when touched — deploy it in YOUR lab forest, not as bait on a network you do not own.
Honeytoken literacy: decoy credentials, fake service accounts, canary files, bogus SPN accounts, and honey-user AD objects designed to generate high-fidelity alerts on any use — Event 4624/4769 on never-used account = strong signal. Defenders place honeytokens in Tier 0-adjacent OUs with strict alerting, document in change control, never use for entrapment outside owned environment. ATT&CK context: detect credential access and lateral movement early. Cyberlium designs honeytoken plan for YOUR $LAB_AD — NOT planting fake creds on stranger systems, NOT 'honeytoken' as excuse to hack neighbors, NOT sharing honeytoken creds publicly. Lab row: one honey account definition, expected Event IDs, SIEM alert name, rollback plan on snapshot revert.
1. Honeytoken types
AD honey user, fake service SPN, decoy share path, canary Kerberos principal — name each.
High signal because legitimate use should be zero on $LAB_AD.
Command guide
Try these commands — Honeytoken types
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Honeytokens — https://attack.mitre.org/techniques/T1552/ (Unsecured Credentials — decoy literacy) Microsoft deception — https://learn.microsoft.com/en-us/security/operations/incident-response-playbooks (detection concepts) adsecurity.org — https://adsecurity.org/ (honey account patterns for defenders)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export LAB_AD=${LAB_AD:-$HOME/cyberlium-lab/t25-ad}
cat > "$LAB_AD/notes/honeytokens.txt" <<'EOF'
honeytoken literacy (YOUR lab):
- decoy DA account with fake description — alert on 4624/4768
- fake SPN service account — alert on 4769
- never deploy on production without blue-team approval
EOFCommand — copy this
grep -E 'decoy|alert|production' "$LAB_AD/notes/honeytokens.txt"
python3 -c "print('Honeytokens: detection tripwires — lab purple-team literacy only')"Primary tools to practice this lesson: python3, grep. Reference sites: Honeytokens (https://attack.mitre.org/techniques/T1552/); Microsoft deception (https://learn.microsoft.com/en-us/security/operations/incident-response-playbooks); adsecurity.org (https://adsecurity.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Deployment ethics
Only systems you admin — lab forest or authorized purple scope with written RoE.
Document in runbook; remove on lab teardown; no public honey cred posts.
3. Alert design
Pair with Event IDs from 8-1 — any logon to HONEY\svc-legacy = Sev1 in lab SIEM table.
Purple: red team touches honey in authorized exercise — blue validates alert fired.
4. What you ship: honeytoken plan row
Three honeytoken types + one lab deployment row + alert + ethics line.
5. What you record before the next lesson
Honeytoken plan path.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Plant honey creds on university file share to 'catch hackers.'
Right
Honeytoken plan for $LAB_AD only. Next: Detection Lab.
Mission: honeytoken plan row
1) Name three honeytoken types. 2) Design one $LAB_AD honey account. 3) Expected Event IDs and alert name. 4) Ethics: owned lab only.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Honey user vs canary SPN — alert difference?”
Knowledge Check
APPLY: Honeytokens purpose:
Multiple choice
Knowledge Check
APPLY: True or False: Plant honey creds on stranger systems.
True or False
Knowledge Check
APPLY: Honey account touch generates:
Multiple choice