Skip to content
Kandaro
Start free trial

Decoy · Device

Active Directory DC decoy

The domain controller is the top prize in a Windows network, and attackers go looking for it as soon as they are inside. This decoy poses as CORP-DC01, with the ports a domain controller opens: LDAP, Kerberos, SMB, RPC and the Global Catalog.

Start free trialAll decoys

What it emulates

Poses as: Active Directory domain controller.

Today it records every connection and the first bytes sent to each port. For decoy accounts inside your real Active Directory, see the Active Directory guide.

  • LDAP 389

    Accepts the connection and records the first bytes sent. It does not speak the protocol yet.

  • LDAPS 636

    Accepts the connection and records the first bytes sent. It does not speak the protocol yet.

  • Kerberos 88/udp

    Records every packet that arrives. Never replies.

  • SMB 445

    Accepts the connection and records the first bytes sent. It does not speak the protocol yet.

  • RPC 135

    Accepts the connection and records the first bytes sent. It does not speak the protocol yet.

  • Global Catalog 3268

    Accepts the connection and records the first bytes sent. It does not speak the protocol yet.

What it catches

Every touch, explained in plain English.

Each event gets a plain-English explanation. Related events from the same source become one incident with a recommended action.

  • Scans looking for domain controllers
  • Connections to LDAP, Kerberos, SMB and RPC

MITRE ATT&CK

Techniques come from a fixed table, not from AI, so the same activity always maps the same way.

  • T1046Network Service Discovery

Incidents go to email, Slack, your SIEM or a signed webhook. Kandaro and your SOC

Safe by design

Built to be attacked. Never a way in.

A decoy only listens and answers with fake data. It never runs code and only connects out to Kandaro, so it can never become a way into your network.

  • It runs nothing

    The sensor has no way to run a command, load code or update itself. Every command an intruder types gets a fake text answer.

  • It connects to one place only

    Its only outbound connection is HTTPS to the Kandaro API address set at install time. Nothing Kandaro sends can change that address.

  • Kandaro can only send it settings

    Which decoy to imitate, which services to turn off, which addresses to ignore. There is no field for code, files, commands or updates.

  • It holds no real secrets

    Passwords, keys and records it shows are fake. Its only credential is its own key, which can send events for your organisation and nothing more.

  • It cannot be used to attack others

    It never forwards traffic, never fetches a URL and never serves scripts or programs. Its only UDP replies (SNMP) are rate-limited per address.

Non-root, read-only container with signed images. How we secure sensors

Where to put it

Place it where an intruder will look.

Put it in the same network as your real domain controllers.

Installs in about a minute with Docker, Kubernetes, Ansible, a VM or a Raspberry Pi, and needs outbound HTTPS only. Deployment guide · Where to put your first decoys

FAQ

Active Directory DC decoy questions

Does it join my domain?
No. It is not part of your domain and holds no accounts. It only looks like a domain controller from the network.
How do I put decoy accounts in my real Active Directory?
Kandaro generates a script your admin reviews and runs. It adds a fake service account and admin user that point at a decoy. See the Active Directory guide in the docs.
Is it safe to run on my network?
Yes. A decoy only answers connections with fake data. It runs nothing, forwards nothing and only connects out to the Kandaro API over HTTPS. It runs as an unprivileged, read-only container.

Related decoys

Pair it with these.

Put this decoy on your network today.

Start a 14-day trial of Kandaro Deception. Your first decoy is running in about a minute.

Start free trialView packages

Card required · cancel before day 14 and pay nothing