Please Waste My Time

The talk opens with a red teamer's view of why Windows enterprise networks are hard to secure. The speaker walks through the weaknesses pentesters rely on: broadcast name resolution poisoning that captures NTLM challenge responses, relaying those authentications to hosts without SMB signing, Kerberoasting service accounts with weak passwords, and reusing local administrator hashes across machines. Each one traces back to a default setting or a common bad practice.

The middle of the talk turns to deception. Ideas include a honey user that looks like a real account and should never be touched, a decoy service principal name that alerts when a ticket is requested, alerts on RC4 ticket requests in an AES-only environment, and fake or disabled local admin accounts planted where credential dumping will find them. Canary tokens embedded in documents on file shares can report when someone opens them. The speaker also shares a small PowerShell tool, built with an AI assistant, that sends decoy name-resolution requests and flags any host that answers, which points to responder-style tooling on the network. Fake documentation and password databases can misdirect intruders as well.

The closing part covers rollout. The speaker recommends starting with a single honeypot, tuning alerts so they only fire on real activity, and not treating deployment as a reason to skip other security work. Legacy systems and backward-compatibility needs slow the move to newer defaults, so many of these weaknesses remain in place.