Account Discovery MITRE ATT&CK technique T1087 Tactic: Discovery Platform: Windows, Linux, Mac Deception Techniques Create fake local or domain accounts Create Kerberoast Service Account honeytoken Useful Tools None Useful Resources Detecting Kerberoasting Activity Part 2 – Creating a Kerberoast Service Account Honeypot Busting the Honeypot – Is there really a way for attackers to detect deception