4 ms·

> If you have internal honeypots then failed attempts to compromise them should be ignored and they should be AD joined (long topic) Would you mind elaborating

• _8j50 3y ago
  Failed attempts generate FPs when random vuln scanners or noisy apps used by IT people try to "discover" resources by attempting logins using whatever credential they have. You want it to be AD joined because if it isn't, you miss out on the most popular means of lateral movement: using domain user/service accounts. Typically bad guys run adfind, sharphound or the like to find easy and valuable targets and attack paths. The honeypot should show up as a valuable target that is only slightly misconfigured (e.g.: domain users can RDP to it and it runs interesting services), so attackers would move to the honeypot using domain credentials that are legitimate. I should have said this in my original post but measures like this and threathunting done right can catch even the most sophisticated APTs (catching them is only the start though)
  • entropyie 3y ago
    Internet facing honeypots have a place in detecting threat actors in the "pre-attack" phase (see MITRE), but you need a more sophisticated methodology to filter out all the background noise from script kiddies. You may find that threat actor's OpSec is less disciplined in the pre attack phase also, meaning you get more chances for real attribution.