An Intranet Lateral Movement Detection Method Based on Honeyusers

Lateral movement attacks within intranets severely impact the security and stability of domain environments. Current defense methods primarily aim to increase the difficulty and cost for attackers during the lateral movement process, thereby thwarting the attack. However, the limitation of these methods is that they are unable to effectively and promptly monitor the status of the domain controller. To address this issue, we propose a detection method specifically for intranet lateral movements based on a set of Honeyusers. This specifically includes, deploy a certain number of honeyusers within the domain accounts as decoys and detect whether the domain controller privileges have been compromised by monitoring the status of honeyusers. First, the honeyuser proposed in this paper, which is generated using simulation-based method effectively confuses attackers, thereby achieving a high level of stealth in detection. Second, experimental tests demonstrate that the honeyuser- based detection method can achieve high success rates of attack detection while utilizing minimal domain resources. Third, for malicious behaviors trying to break through the defense, such as password cracking, the method is also robust.