Note-to-self: using Honeypot to detect Mimikatz Use On Your Network

Source: https://isc.sans.edu/diary/Detecting+Mimikatz+Use+On+Your+Network/19311

In short:”… Here is the idea.   You stage these fake credentials in the memory of computers you suspect might be the initial entry point on your network.   Perhaps all the computers sitting in your DMZ.    For a great deception my friend Rob Fuller (@mubix) is toying with the idea of putting this into the logon scripts to stage fake workstation administrator accounts on all the machines in your network.  Then you would setup alerts on your network that detect the use of the fake accounts.    Be sure to choose a username that an attacker will think is valid and will have high privileges on your domain. …