Skip to content
Get packs

AD Honeytoken Deployment

Plant decoy Active Directory accounts, SPNs and GPOs that alert defenders when attackers touch them

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

This skill teaches an AI agent how to set up deliberately fake ('honeytoken') objects inside a Windows Active Directory domain, such as a tempting legacy admin-style service account, a fake service name that attackers might try to crack, and a decoy Group Policy object containing a fake password. Because no legitimate user should ever touch these objects, any access is a strong signal of an intruder. The skill also includes a Python agent that registers these decoys, generates SIEM detection rules for Splunk, Sentinel and Sigma, and watches Windows security event IDs for interaction.

Great for

  • Security engineers or blue teams who run Active Directory and want high-signal intrusion detection
  • Students learning deception technology and how Kerberoasting or GPP password attacks work
  • Defenders who already forward Windows Security logs to a SIEM and want to add tripwire alerts

Skip it if

  • People without authorized administrative control of the domain: the steps require Domain Admin or delegated rights and could disrupt production identity services if done carelessly
  • Environments without log forwarding to a SIEM, since the honeytokens generate no value unless someone monitors their events

Try asking

  • “Help me deploy a honeytoken service account in our AD domain that alerts on Kerberoasting attempts”
  • “Generate Splunk and Sentinel detection rules for Event IDs 4769 and 4662 tied to our honeytokens”
  • “Walk me through creating a decoy GPO with a fake cpassword trap and enabling SACL auditing”
Step-by-step guide: how to use AD Honeytoken DeploymentInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    deploying-active-directory-honeytokens.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip deploying-active-directory-honeytokens.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip deploying-active-directory-honeytokens.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Run the deployment steps in a lab or test OU first, and confirm the honeytoken accounts cannot authenticate to anything sensitive before going live
  • Review the PowerShell and Python scripts yourself before execution, since they modify directory objects and SYSVOL and may invoke external tools; the script imports subprocess and its network behaviour should be checked
  • Keep honeytoken names and passwords out of shared documentation and ensure only the SOC knows which objects are decoys

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.