Honeytoken Account Logon Activity
This query detects logon activity associated with a honeytoken account. Honeytokens are decoy accounts designed to lure attackers, and any activity on them is a strong indicator of compromise.
// Detects logins involving default administrator accounts
#event_simpleName=/UserLogon.*/i
// Adjust or extend this to match your custom honeytoken accounts
| UserSid = /S-1-5-21-\d*-\d*-\d*-500/iHoneytoken Account Access Detection
This use case is designed to generate an alert when any activity involving a designated honeytoken account is observed. Honeytokens serve as decoys; they are accounts that appear valuable to an attacker but have no legitimate purpose and are heavily monitored. Any interaction with them is highly indicative of malicious activity.
Key Objectives: - Lure Attackers: Create accounts that mimic administrator or service accounts to attract adversarial engagement. - High-Fidelity Alerts: Since these accounts have no legitimate use, any logon event is a high-confidence signal of a breach. - Monitor and Safeguard: Apply Identity Protection policies to monitor these accounts without granting them any actual permissions, making them safe and effective traps.
Query Breakdown:
-
#event_simpleName=/UserLogon.*/i- This line filters for all logon-related events captured by CrowdStrike Falcon. It serves as the primary data source for the detection. -
| UserSid = /S-1-5-21-\d*-\d*-\d*-500/i- This filters the logon events for a specific Security Identifier (SID). The SIDS-1-5-21-...-500is the well-known SID for the default local administrator account on a Windows domain. - Crucially, this value must be replaced with the actual SID(s) of your organization's designated honeytoken accounts.
For more details on creating and managing honeytokens within Falcon Identity Protection, please refer to the official CrowdStrike documentation: - Honeytokens within Falcon Identity Protection
