cyber-deploying-active-directory-honeytokens

name	cyber-deploying-active-directory-honeytokens
description	Deploys deception-based honeytokens in Active Directory including fake privileged accounts with AdminCount=1, fake SPNs for Kerberoasting detection (honeyroasting), decoy GPOs with cpassword traps, and fake BloodHound paths. Monitors Windows Security Event IDs 4769, 4625, 4662, 5136 for honeytoken interaction. Use when implementing AD deception defenses for detecting lateral movement, credential t
hide	true

YURI skill adapter

Authoritative source: .claude/skills/cyber-deploying-active-directory-honeytokens/SKILL.md

Authoritative source SHA-256: e6e0fa798d2579a05418c95cea929c8563de7f2d23ccdd1979928583860cc16b

Source class: cyber-armed

Before acting, read the authoritative source file above completely from beginning to end. If the governed source is absent, run node _SYSTEM/Scripts/skill-recall.mjs --show cyber-deploying-active-directory-honeytokens and read its complete verified output. Follow that source as the skill body; this adapter is a non-authoritative metadata-and-pointer projection.