Any honeytoken program thoughts to share?

[MarshMadness]

I am looking to utilize the MDI honeytoken feature and looking for any suggestions.

In terms of enticement or effort to minimize suspicion, here are my initial thoughts but am certainly open to any input.

• How many
• Type (person, computer, service, resource)
• Permissions
• Location
• Create date
• Logon count/last logon (automation opportunity)
• Group membership
• Title/description
• Mail enabled?

Thanks in advance for your considerations!

[#2]

@MarshMadness You should configure your honeytoken account in the same manner as your other privileged accounts. Same naming convention, same OU, etc. The account should never be used to logon. If assigning domain admin or other privileges make sure to use long complex passwords and have mitigation in place or be prepared to respond in the event of any alerts. It depends on the size of your organization and domain but I would suggest starting with a single account so as to not be overexposed. You have to take into account all of your existing privileged accounts, which while real and in use, are also targets for attackers and contribute to your attack surface.

[#3]

@edinili84 TYVM for your input.

[#4]

You should create as many honeytoken users and devices to make them spread around interesting OUs in AD. I suggest that you give honeytoken users the same permissions and group memberships as other users in the specific OU have but be sure to be able to respond to honeytoken alerts quickly in that case.

When testing honeytoken users and devices I ran into an issue. The alert was triggered only when the honeytoken user or the device made an action and not when I did reconnaissance on the device or user. For example when I tried to authenticate using honeytoken user and wrong password the alert was not triggered.
This got me thinking about how an adversary would even get an access to a honeytoken user/device. If a honeytoken user is not logged on any computer it is possible to get its password hash only from DC from ntds.dit file for which to access you need domain admin privileges. From this conclusion honeytokens are not very useful...

Did you have other experience when testing honeytokens or do you have other opinion or ideas for their usage?

[#5]

Sean Metcalf created a nice blog about this: https://www.hub.trimarcsecurity.com/post/the-art-of-the-honeypot-account-making-the-unusual-look-nor...