Mapping Deception Solutions With BloodHound OpenGraph

This SpecterOps blog outlines a methodology for deploying high-fidelity, low-risk deception controls along real attack paths in Microsoft Configuration Manager (SCCM) and mapping them in BloodHound OpenGraph. It demonstrates creating canary Network Access Accounts (NAA) with auditing, staging deceptive PXE media on Distribution Points with detailed file share auditing (EID 5145), and planting expired credentials in the SC_UserAccount table with SQL audits (EID 33205), while restricting misuse and tracking deceptions via ConfigManBearPig and deceptionClone. The post ties these deceptions to known SCCM attack techniques (e.g., PXE abuse, credential recovery via SCCMHunter) to enable reliable detection without introducing new attack paths.