Deploying Active Directory Honeytokens

Mahipal

Deploys deception-based honeytokens in Active Directory including fake privileged accounts with AdminCount=1, fake SPNs for Kerberoasting detection (honeyroasting), decoy GPOs with cpassword traps, and fake BloodHound paths. Monitors Windows Security Event IDs 4769, 4625, 4662, 5136 for honeytoken interaction.

Install

npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill deploying-active-directory-honeytokens

npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill deploying-active-directory-honeytokens -a claude-code -g

npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill deploying-active-directory-honeytokens -a codex -g

gemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/deploying-active-directory-honeytokens

gh skill install mukul975/Anthropic-Cybersecurity-Skills deploying-active-directory-honeytokens

git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/deploying-active-directory-honeytokens ~/.claude/skills/deploying-active-directory-honeytokens   # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/deploying-active-directory-honeytokens ~/.agents/skills/deploying-active-directory-honeytokens   # Codex, Cursor, Gemini CLI, Copilot, OpenCode

Install

Related