Creating Honey Credentials with LSA Secrets

The report explains how attackers locate systems with SPNs to dump LSASecrets and extract plaintext service account credentials for privilege escalation, and recommends a defensive deception: create realistic-looking service accounts with false passwords stored in LSASecrets and monitor for authentication failures (e.g., Windows 4625) to detect adversary use of the planted credentials.