{"id":13845078,"url":"https://github.com/whoamins/SPN-Honeypot","last_synced_at":"2025-07-12T01:31:38.819Z","repository":{"id":40507811,"uuid":"458614975","full_name":"whoamins/SPN-Honeypot","owner":"whoamins","description":"Example of Kerberoasting Honeypot","archived":false,"fork":false,"pushed_at":"2023-01-06T23:59:47.000Z","size":45,"stargazers_count":16,"open_issues_count":0,"forks_count":1,"subscribers_count":2,"default_branch":"main","last_synced_at":"2024-11-21T18:36:45.077Z","etag":null,"topics":["active-directory","blue-team","cybersecurity","kerberoasting","kerberos","powershell","security","windows"],"latest_commit_sha":null,"homepage":"","language":"PowerShell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/whoamins.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2022-02-12T19:08:26.000Z","updated_at":"2024-06-26T18:10:34.000Z","dependencies_parsed_at":"2023-02-06T09:55:11.454Z","dependency_job_id":null,"html_url":"https://github.com/whoamins/SPN-Honeypot","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/whoamins/SPN-Honeypot","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/whoamins%2FSPN-Honeypot","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/whoamins%2FSPN-Honeypot/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/whoamins%2FSPN-Honeypot/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/whoamins%2FSPN-Honeypot/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/whoamins","download_url":"https://codeload.github.com/whoamins/SPN-Honeypot/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/whoamins%2FSPN-Honeypot/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264923080,"owners_count":23683716,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["active-directory","blue-team","cybersecurity","kerberoasting","kerberos","powershell","security","windows"],"created_at":"2024-08-04T17:03:09.952Z","updated_at":"2025-07-12T01:31:38.557Z","avatar_url":"https://github.com/whoamins.png","language":"PowerShell","funding_links":[],"categories":["PowerShell"],"sub_categories":[],"readme":"# SPN-Honeypot\nDetect Kerberoasting.\n\nThere is an effective way to detect Kerberoasting, which is to create an account and an SPN that will not be used (the created SPN is not associated with any real service). \n\nKerberos clients will never request a TGS ticket for a false SPN, so if the corresponding event 4769 appears in the DC security log, then the exploiting of Kerberoasting can be noticed.\n\n# Installation\n## Step 1\nDownload the archive with scripts and extract it to some place\n\n## Step 2\nRun the *script.ps1* script. It will create fake account and SPN.\n\n```\nPS \u003e ./script.ps1\n```\n\nIf you can't start script because you have Restricted execution policy - Try this command and try to run *script.ps1* again\n\n```\nPS \u003e powershell -ep bypass\n```\n\n## Step 3\nAfter installation - delete plain text password from the script, because it already unnecessary\n\nFor example, set the value to 1.\n\n![изображение](https://user-images.githubusercontent.com/66217512/194409894-2e45def3-c870-4046-a47b-61615cea4589.png)\n\n\n# How it will notify me?\nIf honeypot has been triggered, you will see Windows 10 notification on the right bottom corner (default windows 10 notification)\n\n![image](https://user-images.githubusercontent.com/66217512/157062031-3f52bc72-411f-48f2-b110-04657388b9f3.png)\n\n![изображение](https://user-images.githubusercontent.com/66217512/194408763-58e04bf6-65d6-4a7a-b701-95f0158b19b4.png)\n\n\n# Change the script start time\n\nIf you want to run the script every 2 minutes for instance. You should change this on the third line in *sheduler.ps1* and on the second line in *script.ps1*.\n\n**Attention**: In the *script.ps1* you should change the time in seconds. (300 = 5 min, 120 = 2 min).\n\n# TODO\n\n\n1. GUI with alert history\n2. Connection with some SIEM systems\n3. Update guide\n4. More secure password storage...\n5. Add the ability to choose service exe file6\n6. Check results code - [info](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4769)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwhoamins%2FSPN-Honeypot","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fwhoamins%2FSPN-Honeypot","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fwhoamins%2FSPN-Honeypot/lists"}