Honeypot Detection: how to spot traps in Active Directory

A new article by CYPFER explains how to identify honeypot accounts in an Active Directory domain without generating noise or triggering monitoring alerts. The approach is based on a simple idea: it's relatively easy for a blue team to create accounts that look legitimate by name, description, or group membership — but difficult to fake their activity history.

Instead of standard LDAP queries, the article suggests enumerating accounts through system interfaces LSA and Net (LsaLookupNames2, NetUserEnum, NetUserGetInfo), as well as SAMR (SamEnumerateUsersInDomain and SamQueryInformationUser). These calls use MS‑RPC (port 445), just like legitimate tools, which allows them to blend into normal background traffic.

The key authenticity indicator is the lastLogon attribute: for active accounts the value is nonzero, while for honeypot objects it remains zero (it may appear as 12/31/1600). The same applies to machine accounts: a host functioning in the domain must authenticate regularly.

If multiple domain controllers exist, account attribute values must be checked on each one, since lastLogon isn't replicated between DCs.

Article: https://offsec.cypfer.com/blog/Honeypot-detection

The PoC is attached to the article as a file: https://offsec.cypfer.com/sam_honeypot_enum.c