dcept
A honeytoken-based tripwire for detecting Active Directory credential theft and privilege escalation attempts.
What is dcept?
DCEPT is a honeytoken-based tripwire for Microsoft Active Directory that detects credential theft and privilege escalation attempts. It deploys fake credentials cached on endpoints, and any logon attempt using these tokens signals an intruder is inside the network. The tool provides forensic timelines and helps administrators identify breaches before they escalate.
Windows system administrators and security teams managing Active Directory environments who need to detect lateral movement and credential theft attacks.
Developers choose DCEPT because it offers a free, open-source alternative to commercial detection tools, with a simple deployment via Docker and a focus on educating about real-world attack patterns. Its honeytoken approach provides low-risk, high-visibility detection without compromising valid credentials.
Overview
A tool for deploying and detecting use of Active Directory honeytokens
Use Cases
Best For
- Detecting Active Directory credential theft and privilege escalation attempts
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
