What is DCEPT
A proof-of-concept for an adaptive parallelised DNS prober
Understanding the Three Components of DCEPT
DCEPT consists of three key components that are essential for its functionality.
The first is an agent written in C# that caches honeytokens
The first component is an agent developed in C# that stores honeytokens in memory on the endpoints.
Understanding Honeytokens in DCEPT
The tokens themselves are pieces of information deliberately placed within the system so that they can be found by an intruder. In the case of DCEPT, the honeytokens are credentials that would only be known to someone who has extracted them from memory. If there is a logon attempt using these fake credentials, it indicates that someone has breached the network and is trying to escalate their privileges to that of a domain administrator.
The Objective of This Project
The objective of this project was to offer a free and straightforward honeytoken deployment tool, while also educating administrators about the nature of these attacks. We invite contributors to expand upon our work and welcome any feedback. Has DCEPT assisted your organization in identifying an intrusion before it became critical? We would love to hear from you. Additional information about this research project can be found here: https://www.secureworks.com/blog/dcept
DCEPT Reviews
No reviews yet.
