SR Labs Developed Open Source Product
SIEM Honey Pot
An open-source Certiception honeypot for Active Directory Certificate Services, with a decoy certificate template that raises a high-confidence alert on any attempt to abuse it.
Solution overview
SIEM Honey Pot deploys a decoy in Active Directory Certificate Services to detect attackers attempting lateral movement or privilege escalation. Using SRLabs Certiception, it presents an apparently exploitable certificate template whose use is blocked by TameMyCerts and reported to your existing SIEM. The deployment includes a tested alert flow and documented handover.
Your business needs
Your ADCS environment needs targeted detection
Lateral movement and privilege escalation
Attackers already inside the network can exploit certificate services without triggering reliable alerts.
Alert quality
Noisy detections make it harder for analysts to identify activity that requires attention.
ADCS monitoring
Certificate services may lack the event collection and detection needed to expose suspicious activity.
Who this is for
Security and operations teams
Organizations running Active Directory Certificate Services, with an existing SIEM and a SOC process to investigate alerts.
CISO / Head of SOC
A targeted detection capability for attempted lateral movement and privilege escalation through ADCS.
AD/PKI team
A reviewed deployment with clear PKI ownership and documented protection settings.
SIEM Team / SOC
Configured detection rules and a tested alert flow with documented handling instructions.
Our deliverables
A deployed honeypot and a validated alert flow
The fixed-price deployment package covers one AD environment, one honey CA and one supported SIEM.
- Check the prerequisites — We review infrastructure, access, event forwarding and operational responsibilities.
- Verify that the required events arrive — We check that TameMyCerts event ID 6 and Windows event ID 4886 reach the SIEM.
- Run an end-to-end test — We verify the full chain: interaction, blocked request, event and SIEM alert.
- Deploy Certiception — We set up the honey CA, honey template, TameMyCerts and extended audit logging.
- Convert and configure Sigma rules — We convert and configure the detection rules for the agreed SIEM platform.
- Documentation and handover — We document the deployment, how the alerts are handled and who owns the PKI.
- Preventing the initial compromise
- ADCS or AD hardening and assessments
- SIEM implementation
- 24/7 monitoring and incident response
- Comprehensive deception platforms
- Additional scope of services
How we deliver
From prerequisite checks to a tested alert
-
Review the ADCS environment, event forwarding and customer-provided access.
-
Install the honey CA, honey template and protective policy module.
-
Validate event delivery and configure the SIEM rules.
-
Confirm that attempted exploitation is blocked and produces the expected alert.
-
Document alert handling, protection settings and PKI ownership.
Detection approach
A decoy template with a protected alert path
Honey CA and honey template
A certificate template designed to appear exploitable through an ESC1-style attack.
TameMyCerts
A policy module that blocks the attempted exploitation.
SIEM alert
Relevant events trigger a high-confidence detection for SOC investigation.
Technology partners
Targeted deception connected to your existing SIEM
The deployment uses SRLabs Certiception and integrates the alert flow with a supported SIEM. Ongoing monitoring can be contracted separately.
Frequently asked questions
Before your consulting engagement begins
Active Directory with ADCS, a domain-joined Windows server, required permissions and accounts, change approval and a PKI owner. Your SIEM must already receive the relevant events, with a SOC owner responsible for handling alerts.
The deployment uses TameMyCerts to block the attempted exploitation. Acceptance testing verifies the protection and alert flow. Later PKI changes must preserve the reviewed configuration.
No. The package covers deployment, testing and handover. Your SOC handles the alerts, or separate monitoring can be arranged through Aiuken or Infigo.
Let’s discuss your next step
Tell us about your ADCS environment. Together, we’ll clarify the scope and whether SIEM Honey Pot fits your detection needs.