TLDR Tech / InfoSec
Hunting Honey Pots as Red Teamers
This post details how red teamers can fingerprint Active Directory honeytoken and decoy-computer accounts without ever authenticating against them, reading account metadata through quiet MS-SAMR and LSA calls (SamConnect/SamEnumerateUsersInDomain, LsaLookupNames2, NetUserEnum over RPC port 445) instead of high-signal LDAP sweeps that defenders baseline and alert on. The tell is behavioral rather than structural: a decoy can forge an attractive name and Tier 0 membership but cannot fake history, so a lastLogon of zero (often rendered cosmetically as 12/31/1600 or 1/1/1601) next to a populated logonCount and pwdLastSet exposes the bait, a signal even sharper on dollar-sign machine accounts since domain enrollment forces at least one Netlogon authentication. Defenders should not treat a single tripwire as sufficient and instead layer honeypots with directory-query monitoring, authentication-anomaly detection, and tight control over who can read activity attributes, while confirming non-replicated lastLogon across multiple controllers before trusting it.
Read the full story