Active Directory Cyber Deception using Huginn

Abstract

Huginn helps realise strategic adversary deception concepts from the MITRE Engage framework and the European Central Bank’s cyber resilience report using novel techniques and an open-source program.

We demonstrate creation and monitoring of the following decoy assets during this presentation:

• Certificate Templates (ESC4 & ESC1)
• Computer Object Take-over via RBCD
• Decoy Users
• Decoy Object ACLs
• Retrieve GMSA Passwords

Our objectives are to:

• Reduce the security posture requirements for engaging in cyber deception.
• Balance the intrinsic asymmetry of cyber-attacks by raising high-fidelity alerts around advanced attacker activity.
• Impose cost by embedding high-value deception artefacts within critical attack paths.