How to use the AD Honeytoken Deployment agent skill

What does the skill make the agent do?

Honeytokens are objects that no legitimate user should ever touch, so any access to them is a strong sign of an intruder. This skill covers several kinds: a fake privileged-looking admin account (for example svc_sqlbackup_legacy), a fake SPN that attackers might request tickets for during Kerberoasting, a decoy Group Policy object containing a fake Group Policy Preference password, and fake BloodHound attack paths that lead toward the honeytokens.

The skill also includes a Python agent (scripts/agent.py) that registers the honeytokens, generates detection rules, and watches for interaction. The source names SIEM rule output for Splunk, Sentinel and Sigma, and monitoring of Windows Security event IDs such as 4769, 4625, 4662 and 5136.

• Fake privileged accounts with AdminCount=1, aimed at credential theft
• Fake SPNs for honeyroasting detection (Event ID 4769)
• Decoy GPOs with a cpassword trap (Event IDs 4663 and 4625 are referenced)
• Fake BloodHound paths that misdirect graph-based reconnaissance

How do you install the skill?

Download the ZIP from the skill's page on this site and unzip it. For a personal setup, place the unzipped folder in ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder instead.

If you use the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills.

• Personal install: ~/.claude/skills/deploying-active-directory-honeytokens
• Project install: .claude/skills/deploying-active-directory-honeytokens inside your project

What do you need before you start?

The skill assumes an experienced Windows administration environment. The source lists the following requirements, and the steps will not work without them.

• A Windows Server 2016+ Active Directory domain
• PowerShell 5.1+ with the ActiveDirectory module and GPMC (Group Policy Management Console)
• Windows Event Log forwarding to a SIEM such as Splunk, Sentinel or Elastic
• Python 3 to run scripts/agent.py
• Domain Admin or delegated AD administration privileges

How do you trigger the skill with a natural request?

You do not need to type a command to use a skill. Describe the outcome you want in plain language and mention Active Directory and honeytokens, and the agent should load the skill when it matches the description. Give the agent your domain details (OU, SYSVOL path, naming conventions) so it can fill in the scripts.

Good requests name the goal and the environment, for example: "Plan honeytoken accounts for our production AD, using our Service Accounts OU and naming style, and show how to alert on them in Splunk."

• Plant a honeyroasting SPN on a fake legacy SQL backup account and tell me which event IDs to alert on.
• Create a decoy GPO with a fake Group Policy Preference password and enable SACL auditing.
• Generate Splunk, Sentinel and Sigma detection rules for my registered honeytokens.
• Validate that my existing honeytoken admin account has AdminCount=1 and an audit policy.

What does a typical deployment look like?

The skill's workflow follows six steps: deploy a fake privileged admin account, add a fake SPN, create a decoy GPO with a credential trap, create a deceptive BloodHound path, register honeytokens and generate SIEM rules with the Python agent, and then validate the deployment.

The source shows PowerShell functions for each step, such as New-HoneytokenAdmin, Add-HoneytokenSPN, New-DecoyGPO and Test-HoneytokenDeployment, and a Python example that registers honeytokens with ADHoneytokenMonitor. Review every generated command before running it in your domain.

• Use realistic naming that matches your organisation's conventions
• Repurpose or age accounts so they look legitimate, as the source recommends
• Confirm the SIEM actually receives the event IDs before relying on the alerts

What are the safety notes?

This skill runs scripts and uses the network. The steps create accounts, SPNs and GPOs in a live domain, and the source warns that careless use could disrupt production identity services. Test in a lab or a non-critical OU first, and only run the steps with explicit authorisation to change the domain.

Treat the Python agent and any network-facing behaviour as code you should read before executing. Keep decoy credentials out of real use, and make sure the honeytoken accounts are documented so administrators do not delete them by mistake.

• Only run this with authorised Domain Admin or delegated rights
• Review scripts/agent.py and the PowerShell before execution
• Do not deploy into production without a tested rollback plan
• Honeytokens produce no value unless someone monitors their events

Tips for getting good results

Ask the agent to explain each object it proposes and why it looks realistic. The source notes that attackers compare creation date, last logon and password change date, so consistent aging matters. Ask for the reference API details in references/api-reference.md when you need parameter defaults, such as the default password length of 128 and the default backdate of 5475 days.

• Keep a record of every honeytoken name, DN and SPN
• Start with one honeytoken per type, then expand
• Ask for the detection rules in the SIEM language you actually use