DCEPT (Domain Controller Enticing Password Tripwire) is a honeytoken-based tripwire for Microsoft Active Directory. Honeytokens are pieces of information intentionally littered on system so they can be discovered by an intruder. The honeytokens are credentials that would only be known by a someone extracting them from memory. A logon attempt using these faux credentials would mean someone was inside the network and is attempting privilege escalation to domain administrator.

DCEPT - A tool for deploying and detecting use of Active Directory honeytokens

Discover open source projects across all platforms

Projects

DCEPT - A tool for deploying and detecting use of Active Directory honeytokens

TechStack

Tagcloud

License

Suggested keywords:

Projects

DCEPT - A tool for deploying and detecting use of Active Directory honeytokens

TechStack

Tagcloud

License