Honeytoken and Deception Trap Trigger Response
When a deception trap such as a honey-SPN (EID 4769), canary token callback, honey-account session (EID 4624/4625/4768), or AD decoy object access (EID 4662) is triggered, executes triage, scope determination, attacker isolation, and deception infrastructure update steps.
Prepare
8 steps- Create and update the trap inventory
Periodically verify the inventory containing `token_id`, `token_type` (DNS/document/AWS-key/honey-SPN/decoy-user), `location`, `expected_alert_channel`, `last_rotation`, and `owner` fields for each active trap; without a complete inventory, a trigger cannot be distinguished from a false positive.
- Verify the auditing infrastructure
Confirm the following events are collected in GPO: EID 4769 (Kerberos TGS request), EID 4662 (DS object access), EID 4768/4624/4625 (honey-account session), EID 4663 (honey-file access); verify that the SACL is configured on the decoy object and that SIEM rules (DEC-001…DEC-009) are active.
- Set up honey-SPN and make it realistic
Create a service account with a name resembling a real service using `New-ADUser`, register the SPN with `Set-ADUser -ServicePrincipalNames @{Add="MSSQLSvc/fakesql01.corp.local:1433"}`; simulate `lastLogon`, `logonCount`, and `pwdLastSet` values with a scheduled task; restrict off-hours logons with `logonHours`.
- Set up AD decoy object
Create a decoy user/group with Deploy-Deception or manually; add read auditing for `Everyone` on GUID `d07da11f-8a3d-42b6-b0aa-76c962be719a` (x500uniqueIdentifier) in the SACL; this GUID is only queried by bulk enumeration tools such as PowerView/SharpView, not by normal management tools.
- Place canary tokens