Credential Traps to Detect Attacks Before Privilege Gain

OS Credential Dumping T1003 Extracts hashes, Kerberos tickets, or plaintext passwords from LSASS, SAM, or AD using credential dumping tools Honey credentials harvested from memory, then used in an authentication or lateral movement attempt Very high Credential Stuffing T1110.004 Automated tools replay username and password pairs from prior data breaches against enterprise login portals Any login attempt against a honey account is confirmed unauthorized access, regardless of success Very high Password Spraying T1110.003 Commonly used passwords tested across many user accounts to avoid per-account lockout thresholds Spray campaign reaching honey accounts confirms the attacker’s presence and scope High Kerberoasting T1558.003 Service ticket hashes requested from AD for service accounts, then cracked offline to recover passwords Honey service accounts with realistic names attract ticket requests; subsequent use fires an alert High Valid Accounts T1078 Compromised credentials used to gain access and escalate privileges while appearing as a legitimate user Honey account authentication attempts expose AD enumeration, credential reuse, and lateral movement Very high DCSync T1003.006 AD replication permissions abused from a non-domain controller to extract credential material at scale Replication requests from non-DC systems that include honey account data trigger immediate alerts Very high