🎟️ AD Honey SPN (Kerberoasting Trap)

Fake SPNs in AD that trigger on Kerberoasting.

→ Explore in ATT&CK matrix (2 mappings) Deployment detail

What it is

Create fake Service Principal Names (SPNs) in Active Directory bound to honey service accounts with weak, crackable passwords. When an attacker runs Kerberoasting tools (Rubeus, Impacket), they request TGS tickets for these honey SPNs. The moment a TGS request is made for a honey SPN, it's a zero-false-positive detection of Kerberoasting.

Implementation requirements

Active Directory with write access to create ServicePrincipalName attributes
A dedicated honey service account with a deliberately weak password
SIEM integration monitoring Windows Event ID 4769 (Kerberos Service Ticket Operations) filtered to honey SPN names
OPSEC: The honey SPN must look realistic (e.g., MSSQLSvc/db-prod-07.corp.local:1433) and the service account must have realistic group memberships
Rollback: Remove the SPN, then disable and delete the decoy service account.
Upkeep: Keep the account's password-change date plausible. Monthly proof-of-life ticket request for the SPN from a test host.

Technologies

Windows

ATT&CK coverage 2

Technique	Tactic	Status	Confidence	Tier
T1558 Steal or Forge Kerberos Tickets	Credential Access	confirmed	strong	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (2 sources) Detecting Kerberoasting Activity Part 2 – Creating a Kerberoast Service Account Honeypot — A honeypot account with a fake SPN: any Kerberos service-ticket request for it (event 4769) is malicious. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1558 to its Lures activity.
T1558.003 Kerberoasting	Credential Access	confirmed	strong	T4
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (3 sources) Detecting Kerberoasting Activity Part 2 – Creating a Kerberoast Service Account Honeypot — A honeypot account with a fake SPN: any ticket request for it (event 4769) is malicious. Deploying honeytokens in Active Directory & deceptive BloodHound paths — Fake Kerberoastable users; event 4769 fires because nobody legitimately requests a ticket for the service. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1558.003 Kerberoasting as an adversary behaviour.

Evidence

Deploying honeytokens in Active Directory & deceptive BloodHound paths — Freingruber, R. (APT29a), APT29a Security Blog 2019 industry
Detecting Kerberoasting Activity Part 2 – Creating a Kerberoast Service Account Honeypot — Metcalf, S., ADSecurity.org 2017 practitioner
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard

Research basis: "Deploying honeytokens in Active Directory & How to trick attackers with deceptive BloodHound paths" — APT29a Security Blog, 2019. Industry practice documented by Illusive Networks and Attivo Networks (now SentinelOne).