Forum Discussion

Copper Contributor

Oct 13, 2019

No Honeytoken Activity on DC login ?

Hi,

I have noticed that i do not receive an alert when logging to a Domain Controller with a Honeytoken account.

Is that the normal behavior? (I do receive them on workstation logon..)

Thank You.

EliOfek
Oct 23, 2019
CloudMe , I just confirmed that in case of a local kerberos login, we won't see it as there is no network traffic for it...

EliOfek
Microsoft
Oct 13, 2019
CloudMe , This is a for a DC that is being monitored by a Sensor/ Gateway?

Are you using ATA or AATP ?

Were proper events turned on as recommended in the docs?
- CloudMe
  Copper Contributor
  Oct 14, 2019
  EliOfek
  
  Its a sensor monitored DC using AATP with audit event enabled according to this document:
  https://docs.microsoft.com/en-us/azure-advanced-threat-protection/atp-advanced-audit-policy
  - EliOfek
    Microsoft
    Oct 15, 2019
    CloudMe , did you enable all the event id's that are mentioned here:
    
    https://docs.microsoft.com/en-us/azure-advanced-threat-protection/configure-windows-event-collection
    
    ?

Share

Resources