Lion Cipher Lab
Active Directory-native deception: a honey user, a decoy SPN, and a SACL tripwire that fires when an attacker looks
- SOC Analyst / Blue Team
- Intermediate
- ~75 min
- Free · no account required
Why it matters
Once an intruder gets a single foothold in a Windows shop, the very first thing they do is enumerate Active Directory — every user, every group, every service account — because AD is the map to everything worth stealing. Tools like BloodHound exist to automate exactly that walk. Host-based decoys (bait files, honey local accounts) sit on one machine; the attacker may never touch that machine. AD-native decoys sit in the directory itself, where the attacker is guaranteed to look. That is what makes them so powerful: you plant an account and an SPN that no human and no service ever has a reason…
What you'll learn
- Deception engineering inside Active Directory (not just on the host)
- Building a honey user: a decoy domain account nobody should ever authenticate as
- Registering a decoy SPN so the account surfaces in a Kerberoast sweep
- SACL / DACL fundamentals and object-level audit ACEs
- Enabling 'Audit Directory Service Access' and reading Event ID 4662
- Recognising the honey-user signatures in Event IDs 4624/4768 (logon) and 4769 (roast)
- Writing a near-zero-false-positive detection rule shape
- MITRE Engage / D3FEND deception framing and MITRE ATT&CK T1558.003
Steps in this lab
- What AD-native deception is — and why it is the next rung
- Get a lab AD if you do not already have one
- Rule one and rule two — the judgment that decides if deception helps or hurts
- Tripwire #1 — create the honey user (a D3FEND Decoy User Credential)
- Tripwire #2 — register a decoy SPN so the honey user is Kerberoastable
- Tripwire #3 — a SACL that fires the moment an attacker READS the object
- Turn on the recorders BEFORE you attack
- Simulate the attacker — trip all three wires yourself (your own lab only)
- Confirm the events fired — read them like an analyst
- The detection rule shape — and why it is near-zero false positives by design
- Where AD decoys beat more logging, the ceiling, and what you learned