Skill UI

This tool automates the deployment of deception-based honeytokens within Active Directory environments. It creates fake privileged accounts, decoy SPNs for Kerberoasting detection, and misleading GPOs with password traps. Designed for advanced security teams to detect reconnaissance, lateral movement, and credential theft with high fidelity.

This skill enables comprehensive security graph mapping by ingesting both on-premises Active Directory data (via SharpHound) and cloud Entra ID data (via AzureHound) into BloodHound CE. It analyzes complex, hybrid attack paths, allowing security teams to identify critical privilege escalation chains from low-privileged accounts to Tier-0 assets, mapping findings to MITRE ATT&CK.