[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AE78W6PF1RW4GWKF49KVMS":3,"skill-same:01M6AE78W6PF1RW4GWKF49KVMS":110},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":34,"linkOnly":35,"markdownContent":36,"markdownBody":37,"frontMatter":38,"refName":53,"commitSha":54,"skillDirectory":55,"forksCount":56,"repositoryHtmlUrl":57,"repositoryHomepageUrl":58,"ownerHtmlUrl":59,"ownerBlogUrl":60,"ownerDescription":61,"updatedAt":62,"install":63,"resources":76},"01M6AE78W6PF1RW4GWKF49KVMS","deploying-active-directory-honeytokens",null,"Deploys deception-based honeytokens in Active Directory including fake privileged accounts with AdminCount=1, fake SPNs for Kerberoasting detection (honeyroasting), decoy GPOs with cpassword traps, and fake BloodHound paths. Monitors Windows Security Event IDs 4769, 4625, 4662, 5136 for honeytoken interaction. Use when implementing AD deception defenses for detecting lateral movement, credential theft, and reconnaissance.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-active-directory-honeytokens\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33],"directory","deploying active directory honeytokens","security","cybersecurity","windows","pr","active-directory","reconnaissance","bloodhound","ids","honeytokens","kerberoasting","deception","detection","gpo","2026-11-10 10:12:30",false,"---\nname: deploying-active-directory-honeytokens\ndescription: 'Deploys deception-based honeytokens in Active Directory including fake\n  privileged accounts with AdminCount=1, fake SPNs for Kerberoasting detection (honeyroasting),\n  decoy GPOs with cpassword traps, and fake BloodHound paths. Monitors Windows Security\n  Event IDs 4769, 4625, 4662, 5136 for honeytoken interaction. Use when implementing\n  AD deception defenses for detecting lateral movement, credential theft, and reconnaissance.\n\n  '\ndomain: cybersecurity\nsubdomain: deception-technology\ntags:\n- active-directory\n- honeytokens\n- kerberoasting\n- deception\n- detection\n- bloodhound\n- gpo\nversion: '1.0'\nauthor: mukul975\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\n- DE.AE-06\n- PR.IR-01\nmitre_attack:\n- T1558.003\n- T1558.004\n- T1110.003\n- T1003.006\n- T1552.006\n---\n\n# Deploying Active Directory Honeytokens\n\n## When to Use\n\n- When deploying deception-based detection in Active Directory environments\n- When detecting Kerberoasting attacks via fake SPN honeytokens (honeyroasting)\n- When creating tripwire accounts to detect credential theft and lateral movement\n- When building decoy GPOs to detect Group Policy Preference password harvesting\n- When creating deceptive BloodHound paths to misdirect and detect attackers\n- When supplementing existing AD monitoring with high-fidelity detection signals\n\n## Prerequisites\n\n- Domain Admin or delegated AD administration privileges\n- Active Directory domain (Windows Server 2016+ recommended)\n- Windows Event Log forwarding to SIEM (Splunk, Sentinel, Elastic)\n- PowerShell 5.1+ with ActiveDirectory module\n- Group Policy Management Console (GPMC)\n- Understanding of AD security, Kerberos, and BloodHound attack paths\n\n## Background\n\n### Why AD Honeytokens\n\nTraditional signature-based detection misses novel attack techniques. Honeytokens\nprovide high-fidelity detection with near-zero false positives because any interaction\nwith a decoy object is inherently suspicious. In Active Directory:\n\n- **Fake privileged accounts** detect credential dumping (DCSync, NTDS.dit extraction)\n- **Fake SPNs** detect Kerberoasting reconnaissance (TGS requests for nonexistent services)\n- **Decoy GPOs** detect Group Policy Preference password harvesting\n- **Fake BloodHound paths** mislead attackers using graph-based AD analysis\n\n### Key Detection Event IDs\n\n| Event ID | Description | Honeytoken Use |\n|----------|-------------|----------------|\n| 4769 | Kerberos TGS ticket requested | Detect Kerberoast against honey SPN |\n| 4625 | Failed logon attempt | Detect use of fake credentials from decoy GPO |\n| 4662 | Directory service object accessed | Detect DACL read on honeytoken user |\n| 5136 | Directory service object modified | Detect modification of decoy GPO |\n| 5137 | Directory service object created | Detect GPO creation mimicking decoy |\n| 4768 | Kerberos TGT requested | Detect AS-REP roasting of honey account |\n\n### Making Honeytokens Realistic\n\nPer Trimarc Security research, effective honeytokens must appear legitimate:\n\n- **Age the account**: Repurpose old inactive accounts (10-15 year old accounts in\n  similarly aged domains appear authentic)\n- **Set AdminCount=1**: Flags the account as having elevated AD rights, making it\n  an attractive Kerberoasting target\n- **Use realistic naming**: Match organizational naming conventions (svc_sqlbackup,\n  admin.maintenance, svc_exchange_legacy)\n- **Set old password date**: Password age of 10+ years with an SPN looks like a\n  high-value, neglected service account to attackers\n- **Add group memberships**: Place in visible groups like \"Remote Desktop Users\" or\n  a custom \"Backup Operators\" to increase attacker interest\n- **Avoid detection tells**: Attackers check creation date vs. last logon vs.\n  password change date for consistency\n\n## Instructions\n\n### Step 1: Deploy Fake Privileged Admin Account\n\nCreate a honeytoken account that mimics a legacy privileged service account.\n\n```powershell\n# Import the deployment module\nImport-Module .\\scripts\\Deploy-ADHoneytokens.ps1\n\n# Create a honeytoken admin account\n$honeyAdmin = New-HoneytokenAdmin `\n    -SamAccountName \"svc_sqlbackup_legacy\" `\n    -DisplayName \"SQL Backup Service (Legacy)\" `\n    -Description \"Legacy SQL Server backup service account - DO NOT DELETE\" `\n    -OU \"OU=Service Accounts,DC=corp,DC=example,DC=com\" `\n    -PasswordLength 128 `\n    -SetAdminCount $true\n\nWrite-Host \"Honeytoken admin created: $($honeyAdmin.DistinguishedName)\"\n```\n\n### Step 2: Deploy Fake SPN for Kerberoasting Detection\n\nAssign a realistic but fake SPN to the honeytoken account. Any TGS request\nfor this SPN is definitively malicious (honeyroasting).\n\n```powershell\n# Add fake SPN to honeytoken account\n$honeySPN = Add-HoneytokenSPN `\n    -SamAccountName \"svc_sqlbackup_legacy\" `\n    -ServiceClass \"MSSQLSvc\" `\n    -Hostname \"sql-legacy-bak01.corp.example.com\" `\n    -Port 1433\n\nWrite-Host \"Honey SPN registered: $($honeySPN.SPN)\"\nWrite-Host \"Monitor Event ID 4769 for TGS requests targeting this SPN\"\n```\n\n### Step 3: Deploy Decoy GPO with Credential Trap\n\nCreate a fake GPO in SYSVOL with an embedded cpassword (Group Policy Preference\npassword). Attackers using tools like Get-GPPPassword or gpp-decrypt will find\nand attempt to use these credentials, triggering detection.\n\n```powershell\n# Create decoy GPO with cpassword trap\n$decoyGPO = New-DecoyGPO `\n    -GPOName \"Server Maintenance Policy (Legacy)\" `\n    -DecoyUsername \"admin_maintenance\" `\n    -DecoyDomain \"CORP\" `\n    -SYSVOLPath \"\\\\corp.example.com\\SYSVOL\\corp.example.com\\Policies\" `\n    -EnableAuditSACL $true\n\nWrite-Host \"Decoy GPO created: $($decoyGPO.GPOGuid)\"\nWrite-Host \"SACL audit enabled - any read attempt will generate Event ID 4663\"\n```\n\n### Step 4: Create Deceptive BloodHound Paths\n\nSet ACL permissions that create fake attack paths visible to BloodHound\u002FSharpHound\nreconnaissance, leading attackers toward monitored honeytokens.\n\n```powershell\n# Create fake BloodHound attack path\n$deceptivePath = New-DeceptiveBloodHoundPath `\n    -HoneytokenSamAccount \"svc_sqlbackup_legacy\" `\n    -TargetHighValueGroup \"Domain Admins\" `\n    -IntermediateOU \"OU=Service Accounts,DC=corp,DC=example,DC=com\"\n\nWrite-Host \"Deceptive path created: $($deceptivePath.PathDescription)\"\n```\n\n### Step 5: Configure Detection Rules\n\nSet up SIEM detection rules to alert on any honeytoken interaction.\n\n```python\n# Using the Python detection agent\nfrom agent import ADHoneytokenMonitor\n\nmonitor = ADHoneytokenMonitor(config_path=\"honeytoken_config.json\")\n\n# Register all honeytokens for monitoring\nmonitor.register_honeytoken(\"svc_sqlbackup_legacy\", token_type=\"admin_account\")\nmonitor.register_honeytoken(\"MSSQLSvc\u002Fsql-legacy-bak01.corp.example.com:1433\", token_type=\"spn\")\nmonitor.register_honeytoken(\"admin_maintenance\", token_type=\"gpo_credential\")\n\n# Generate SIEM detection rules\nsplunk_rules = monitor.generate_detection_rules(siem=\"splunk\")\nsentinel_rules = monitor.generate_detection_rules(siem=\"sentinel\")\nsigma_rules = monitor.generate_detection_rules(siem=\"sigma\")\n\nfor rule in sigma_rules:\n    print(f\"Rule: {rule['title']}\")\n    print(f\"  Detection: {rule['detection_logic']}\")\n```\n\n### Step 6: Validate Deployment\n\nTest the honeytokens to ensure detection fires correctly.\n\n```powershell\n# Validate honeytoken deployment\n$validation = Test-HoneytokenDeployment `\n    -SamAccountName \"svc_sqlbackup_legacy\" `\n    -ValidateAdminCount `\n    -ValidateSPN `\n    -ValidateGPODecoy `\n    -ValidateAuditPolicy\n\n$validation | Format-Table Check, Status, Details -AutoSize\n```\n\n## Examples\n\n### Full Deployment Pipeline\n\n```powershell\nImport-Module .\\scripts\\Deploy-ADHoneytokens.ps1\n\n# Deploy complete honeytoken suite\n$deployment = Deploy-FullHoneytokenSuite `\n    -Environment \"Production\" `\n    -ServiceAccountOU \"OU=Service Accounts,DC=corp,DC=example,DC=com\" `\n    -SYSVOLPath \"\\\\corp.example.com\\SYSVOL\\corp.example.com\\Policies\" `\n    -TokenCount 3 `\n    -IncludeSPN $true `\n    -IncludeGPODecoy $true `\n    -IncludeBloodHoundPath $true `\n    -SIEMType \"Splunk\"\n\n# Output deployment report\n$deployment.Tokens | Format-Table Name, Type, SPN, DetectionRule -AutoSize\n$deployment | Export-Csv \"honeytoken_deployment_report.csv\" -NoTypeInformation\n```\n\n### Kerberoasting Detection Query (Splunk)\n\n```spl\nindex=wineventlog EventCode=4769 ServiceName=\"svc_sqlbackup_legacy\"\n| eval alert_severity=\"critical\"\n| eval alert_type=\"honeytoken_kerberoast\"\n| table _time, src_ip, Account_Name, ServiceName, Ticket_Encryption_Type\n| sort - _time\n```\n\n### Microsoft Sentinel KQL Detection\n\n```kql\nSecurityEvent\n| where EventID == 4769\n| where ServiceName in (\"svc_sqlbackup_legacy\", \"svc_exchange_legacy\")\n| extend AlertType = \"Honeytoken Kerberoast Detected\"\n| project TimeGenerated, Computer, Account, ServiceName, IpAddress, TicketEncryptionType\n```\n\n## References\n\n- Trimarc Security - The Art of the Honeypot Account: https:\u002F\u002Fwww.hub.trimarcsecurity.com\u002Fpost\u002Fthe-art-of-the-honeypot-account-making-the-unusual-look-normal\n- ADSecurity.org - Detecting Kerberoasting Activity Part 2 (Honeypot): https:\u002F\u002Fadsecurity.org\u002F?p=3513\n- Microsoft Defender for Identity Honeytokens: https:\u002F\u002Ftechcommunity.microsoft.com\u002Fblog\u002Fmicrosoftthreatprotectionblog\u002Fdeceptive-defense-best-practices-for-identity-based-honeytokens-in-microsoft-def\u002F3851641\n- SpecterOps - Kerberoasting and AES-256: https:\u002F\u002Fspecterops.io\u002Fblog\u002F2025\u002F10\u002F21\u002Fis-kerberoasting-still-a-risk-when-aes-256-kerberos-encryption-is-enabled\u002F\n- APT29a Blog - Deploying Honeytokens in AD: https:\u002F\u002Fapt29a.blogspot.com\u002F2019\u002F11\u002Fdeploying-honeytokens-in-active.html\n- ADSecurity.org - Detecting Kerberoasting Activity: https:\u002F\u002Fadsecurity.org\u002F?p=3458\n","# Deploying Active Directory Honeytokens\n\n## When to Use\n\n- When deploying deception-based detection in Active Directory environments\n- When detecting Kerberoasting attacks via fake SPN honeytokens (honeyroasting)\n- When creating tripwire accounts to detect credential theft and lateral movement\n- When building decoy GPOs to detect Group Policy Preference password harvesting\n- When creating deceptive BloodHound paths to misdirect and detect attackers\n- When supplementing existing AD monitoring with high-fidelity detection signals\n\n## Prerequisites\n\n- Domain Admin or delegated AD administration privileges\n- Active Directory domain (Windows Server 2016+ recommended)\n- Windows Event Log forwarding to SIEM (Splunk, Sentinel, Elastic)\n- PowerShell 5.1+ with ActiveDirectory module\n- Group Policy Management Console (GPMC)\n- Understanding of AD security, Kerberos, and BloodHound attack paths\n\n## Background\n\n### Why AD Honeytokens\n\nTraditional signature-based detection misses novel attack techniques. Honeytokens\nprovide high-fidelity detection with near-zero false positives because any interaction\nwith a decoy object is inherently suspicious. In Active Directory:\n\n- **Fake privileged accounts** detect credential dumping (DCSync, NTDS.dit extraction)\n- **Fake SPNs** detect Kerberoasting reconnaissance (TGS requests for nonexistent services)\n- **Decoy GPOs** detect Group Policy Preference password harvesting\n- **Fake BloodHound paths** mislead attackers using graph-based AD analysis\n\n### Key Detection Event IDs\n\n| Event ID | Description | Honeytoken Use |\n|----------|-------------|----------------|\n| 4769 | Kerberos TGS ticket requested | Detect Kerberoast against honey SPN |\n| 4625 | Failed logon attempt | Detect use of fake credentials from decoy GPO |\n| 4662 | Directory service object accessed | Detect DACL read on honeytoken user |\n| 5136 | Directory service object modified | Detect modification of decoy GPO |\n| 5137 | Directory service object created | Detect GPO creation mimicking decoy |\n| 4768 | Kerberos TGT requested | Detect AS-REP roasting of honey account |\n\n### Making Honeytokens Realistic\n\nPer Trimarc Security research, effective honeytokens must appear legitimate:\n\n- **Age the account**: Repurpose old inactive accounts (10-15 year old accounts in\n  similarly aged domains appear authentic)\n- **Set AdminCount=1**: Flags the account as having elevated AD rights, making it\n  an attractive Kerberoasting target\n- **Use realistic naming**: Match organizational naming conventions (svc_sqlbackup,\n  admin.maintenance, svc_exchange_legacy)\n- **Set old password date**: Password age of 10+ years with an SPN looks like a\n  high-value, neglected service account to attackers\n- **Add group memberships**: Place in visible groups like \"Remote Desktop Users\" or\n  a custom \"Backup Operators\" to increase attacker interest\n- **Avoid detection tells**: Attackers check creation date vs. last logon vs.\n  password change date for consistency\n\n## Instructions\n\n### Step 1: Deploy Fake Privileged Admin Account\n\nCreate a honeytoken account that mimics a legacy privileged service account.\n\n```powershell\n# Import the deployment module\nImport-Module .\\scripts\\Deploy-ADHoneytokens.ps1\n\n# Create a honeytoken admin account\n$honeyAdmin = New-HoneytokenAdmin `\n    -SamAccountName \"svc_sqlbackup_legacy\" `\n    -DisplayName \"SQL Backup Service (Legacy)\" `\n    -Description \"Legacy SQL Server backup service account - DO NOT DELETE\" `\n    -OU \"OU=Service Accounts,DC=corp,DC=example,DC=com\" `\n    -PasswordLength 128 `\n    -SetAdminCount $true\n\nWrite-Host \"Honeytoken admin created: $($honeyAdmin.DistinguishedName)\"\n```\n\n### Step 2: Deploy Fake SPN for Kerberoasting Detection\n\nAssign a realistic but fake SPN to the honeytoken account. Any TGS request\nfor this SPN is definitively malicious (honeyroasting).\n\n```powershell\n# Add fake SPN to honeytoken account\n$honeySPN = Add-HoneytokenSPN `\n    -SamAccountName \"svc_sqlbackup_legacy\" `\n    -ServiceClass \"MSSQLSvc\" `\n    -Hostname \"sql-legacy-bak01.corp.example.com\" `\n    -Port 1433\n\nWrite-Host \"Honey SPN registered: $($honeySPN.SPN)\"\nWrite-Host \"Monitor Event ID 4769 for TGS requests targeting this SPN\"\n```\n\n### Step 3: Deploy Decoy GPO with Credential Trap\n\nCreate a fake GPO in SYSVOL with an embedded cpassword (Group Policy Preference\npassword). Attackers using tools like Get-GPPPassword or gpp-decrypt will find\nand attempt to use these credentials, triggering detection.\n\n```powershell\n# Create decoy GPO with cpassword trap\n$decoyGPO = New-DecoyGPO `\n    -GPOName \"Server Maintenance Policy (Legacy)\" `\n    -DecoyUsername \"admin_maintenance\" `\n    -DecoyDomain \"CORP\" `\n    -SYSVOLPath \"\\\\corp.example.com\\SYSVOL\\corp.example.com\\Policies\" `\n    -EnableAuditSACL $true\n\nWrite-Host \"Decoy GPO created: $($decoyGPO.GPOGuid)\"\nWrite-Host \"SACL audit enabled - any read attempt will generate Event ID 4663\"\n```\n\n### Step 4: Create Deceptive BloodHound Paths\n\nSet ACL permissions that create fake attack paths visible to BloodHound\u002FSharpHound\nreconnaissance, leading attackers toward monitored honeytokens.\n\n```powershell\n# Create fake BloodHound attack path\n$deceptivePath = New-DeceptiveBloodHoundPath `\n    -HoneytokenSamAccount \"svc_sqlbackup_legacy\" `\n    -TargetHighValueGroup \"Domain Admins\" `\n    -IntermediateOU \"OU=Service Accounts,DC=corp,DC=example,DC=com\"\n\nWrite-Host \"Deceptive path created: $($deceptivePath.PathDescription)\"\n```\n\n### Step 5: Configure Detection Rules\n\nSet up SIEM detection rules to alert on any honeytoken interaction.\n\n```python\n# Using the Python detection agent\nfrom agent import ADHoneytokenMonitor\n\nmonitor = ADHoneytokenMonitor(config_path=\"honeytoken_config.json\")\n\n# Register all honeytokens for monitoring\nmonitor.register_honeytoken(\"svc_sqlbackup_legacy\", token_type=\"admin_account\")\nmonitor.register_honeytoken(\"MSSQLSvc\u002Fsql-legacy-bak01.corp.example.com:1433\", token_type=\"spn\")\nmonitor.register_honeytoken(\"admin_maintenance\", token_type=\"gpo_credential\")\n\n# Generate SIEM detection rules\nsplunk_rules = monitor.generate_detection_rules(siem=\"splunk\")\nsentinel_rules = monitor.generate_detection_rules(siem=\"sentinel\")\nsigma_rules = monitor.generate_detection_rules(siem=\"sigma\")\n\nfor rule in sigma_rules:\n    print(f\"Rule: {rule['title']}\")\n    print(f\"  Detection: {rule['detection_logic']}\")\n```\n\n### Step 6: Validate Deployment\n\nTest the honeytokens to ensure detection fires correctly.\n\n```powershell\n# Validate honeytoken deployment\n$validation = Test-HoneytokenDeployment `\n    -SamAccountName \"svc_sqlbackup_legacy\" `\n    -ValidateAdminCount `\n    -ValidateSPN `\n    -ValidateGPODecoy `\n    -ValidateAuditPolicy\n\n$validation | Format-Table Check, Status, Details -AutoSize\n```\n\n## Examples\n\n### Full Deployment Pipeline\n\n```powershell\nImport-Module .\\scripts\\Deploy-ADHoneytokens.ps1\n\n# Deploy complete honeytoken suite\n$deployment = Deploy-FullHoneytokenSuite `\n    -Environment \"Production\" `\n    -ServiceAccountOU \"OU=Service Accounts,DC=corp,DC=example,DC=com\" `\n    -SYSVOLPath \"\\\\corp.example.com\\SYSVOL\\corp.example.com\\Policies\" `\n    -TokenCount 3 `\n    -IncludeSPN $true `\n    -IncludeGPODecoy $true `\n    -IncludeBloodHoundPath $true `\n    -SIEMType \"Splunk\"\n\n# Output deployment report\n$deployment.Tokens | Format-Table Name, Type, SPN, DetectionRule -AutoSize\n$deployment | Export-Csv \"honeytoken_deployment_report.csv\" -NoTypeInformation\n```\n\n### Kerberoasting Detection Query (Splunk)\n\n```spl\nindex=wineventlog EventCode=4769 ServiceName=\"svc_sqlbackup_legacy\"\n| eval alert_severity=\"critical\"\n| eval alert_type=\"honeytoken_kerberoast\"\n| table _time, src_ip, Account_Name, ServiceName, Ticket_Encryption_Type\n| sort - _time\n```\n\n### Microsoft Sentinel KQL Detection\n\n```kql\nSecurityEvent\n| where EventID == 4769\n| where ServiceName in (\"svc_sqlbackup_legacy\", \"svc_exchange_legacy\")\n| extend AlertType = \"Honeytoken Kerberoast Detected\"\n| project TimeGenerated, Computer, Account, ServiceName, IpAddress, TicketEncryptionType\n```\n\n## References\n\n- Trimarc Security - The Art of the Honeypot Account: https:\u002F\u002Fwww.hub.trimarcsecurity.com\u002Fpost\u002Fthe-art-of-the-honeypot-account-making-the-unusual-look-normal\n- ADSecurity.org - Detecting Kerberoasting Activity Part 2 (Honeypot): https:\u002F\u002Fadsecurity.org\u002F?p=3513\n- Microsoft Defender for Identity Honeytokens: https:\u002F\u002Ftechcommunity.microsoft.com\u002Fblog\u002Fmicrosoftthreatprotectionblog\u002Fdeceptive-defense-best-practices-for-identity-based-honeytokens-in-microsoft-def\u002F3851641\n- SpecterOps - Kerberoasting and AES-256: https:\u002F\u002Fspecterops.io\u002Fblog\u002F2025\u002F10\u002F21\u002Fis-kerberoasting-still-a-risk-when-aes-256-kerberos-encryption-is-enabled\u002F\n- APT29a Blog - Deploying Honeytokens in AD: https:\u002F\u002Fapt29a.blogspot.com\u002F2019\u002F11\u002Fdeploying-honeytokens-in-active.html\n- ADSecurity.org - Detecting Kerberoasting Activity: https:\u002F\u002Fadsecurity.org\u002F?p=3458\n",{"name":5,"tags":39,"author":9,"domain":22,"license":15,"version":40,"nist_csf":41,"subdomain":45,"description":46,"mitre_attack":47},[25,29,30,31,32,27,33],"1.0",[42,43,44],"DE.CM-01","DE.AE-06","PR.IR-01","deception-technology","Deploys deception-based honeytokens in Active Directory including fake privileged accounts with AdminCount=1, fake SPNs for Kerberoasting detection (honeyroasting), decoy GPOs with cpassword traps, and fake BloodHound paths. Monitors Windows Security Event IDs 4769, 4625, 4662, 5136 for honeytoken interaction. Use when implementing AD deception defenses for detecting lateral movement, credential theft, and reconnaissance.\n",[48,49,50,51,52],"T1558.003","T1558.004","T1110.003","T1003.006","T1552.006","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fdeploying-active-directory-honeytokens",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":64,"prompt":74,"zipAvailable":75},[65,68,71],{"tool":66,"command":67},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill deploying-active-directory-honeytokens",{"tool":69,"command":70},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill deploying-active-directory-honeytokens",{"tool":72,"command":73},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill deploying-active-directory-honeytokens","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-active-directory-honeytokens\u002FSKILL.md",true,[77,82,88,92,96,100,106],{"path":78,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":80,"sourceHtmlUrl":81},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-active-directory-honeytokens\u002FLICENSE",{"path":83,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":86,"sourceHtmlUrl":87},"references\u002Fapi-reference.md","REFERENCE","参考文档",12004,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-active-directory-honeytokens\u002Freferences\u002Fapi-reference.md",{"path":89,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":90,"sourceHtmlUrl":91},"references\u002Fdocs-context.md",1343,"https:\u002F\u002Fgithub.com\u002Fmakura-games\u002Fsunrise-station\u002Fblob\u002Fmaster\u002F.agents\u002Fskills\u002Fss14-naming-conventions\u002Freferences\u002Fdocs-context.md",{"path":93,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":94,"sourceHtmlUrl":95},"references\u002Ffresh-pattern-catalog.md",2362,"https:\u002F\u002Fgithub.com\u002Fmakura-games\u002Fsunrise-station\u002Fblob\u002Fmaster\u002F.agents\u002Fskills\u002Fss14-naming-conventions\u002Freferences\u002Ffresh-pattern-catalog.md",{"path":97,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":98,"sourceHtmlUrl":99},"references\u002Frejected-snippets.md",2058,"https:\u002F\u002Fgithub.com\u002Fmakura-games\u002Fsunrise-station\u002Fblob\u002Fmaster\u002F.agents\u002Fskills\u002Fss14-naming-conventions\u002Freferences\u002Frejected-snippets.md",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"scripts\u002Fagent.py","SCRIPT","脚本",53930,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-active-directory-honeytokens\u002Fscripts\u002Fagent.py",{"path":107,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":108,"sourceHtmlUrl":109},"scripts\u002FDeploy-ADHoneytokens.ps1",22762,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeploying-active-directory-honeytokens\u002Fscripts\u002FDeploy-ADHoneytokens.ps1",[111,140,164,191,216,243],{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":122,"publishedAt":34},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[117],{"categoryNo":118,"categoryName":119,"taxonomyType":120,"taxonomyTypeDesc":121},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[123,124,125,126,21,22,127,128,24,129,130,131,132,133,134,135,136,137,138,139],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":141,"name":142,"nameZh":6,"description":143,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":147,"publishedAt":34},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[146],{"categoryNo":118,"categoryName":119,"taxonomyType":120,"taxonomyTypeDesc":121},[148,136,149,150,21,151,22,24,152,153,154,155,156,157,158,159,160,161,162,163],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":165,"name":166,"nameZh":6,"description":167,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":168,"categories":169,"keywords":174,"publishedAt":34},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[170,173],{"categoryNo":171,"categoryName":172,"taxonomyType":120,"taxonomyTypeDesc":121},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":118,"categoryName":119,"taxonomyType":120,"taxonomyTypeDesc":121},[158,175,176,177,178,22,179,180,152,181,182,183,184,185,32,186,187,188,189,190],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":192,"name":193,"nameZh":6,"description":194,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":195,"categories":196,"keywords":198,"publishedAt":34},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[197],{"categoryNo":118,"categoryName":119,"taxonomyType":120,"taxonomyTypeDesc":121},[23,199,200,22,201,202,203,204,205,206,207,208,209,210,211,212,155,213,214,215],"kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":217,"name":218,"nameZh":6,"description":219,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":220,"categories":221,"keywords":223,"publishedAt":34},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[222],{"categoryNo":118,"categoryName":119,"taxonomyType":120,"taxonomyTypeDesc":121},[224,225,226,22,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":244,"name":245,"nameZh":6,"description":246,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":247,"categories":248,"keywords":250,"publishedAt":34},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[249],{"categoryNo":118,"categoryName":119,"taxonomyType":120,"taxonomyTypeDesc":121},[21,251,22,252,253,254,255,256,257,258,259,186,260,187,261,262,263,264,265,266],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]