Claymore Deception Platform
Claymore Decoys look exactly like the weaknesses attackers hunt for in Active Directory. Nothing legitimate ever touches them, so the first thing that does is an intruder.
The problem
Active Directory is the target, and the least watched system you own
Active Directory decides who every user is and what they can reach. Control it and you control everything downstream, so it is where an attacker goes straight after their first foothold.
The techniques are not exotic. They are documented, automated, and in every offensive playbook, and they still succeed against well-run networks because most of them look like ordinary activity.
A five stage flow. An attacker gains a foothold on one workstation, then enumerates Active Directory. Enumeration returns nine objects: five genuine ones and four Claymore decoys that are indistinguishable from them. Touching any decoy raises an alert within seconds and names the account and source address. A certificate request is denied, a tampered decoy is restored, and, if you allow it, the attacker account is disabled. Domain admin, the attacker’s goal, is never reached.
01Foothold
02Enumeration
03What the directory returns
04Interaction is the detection
- Alert raised within seconds
- Account and source address named
- Certificate request denied
- Tampered decoy restored
- Attacker account disabled, if you allow it
05Never reached
Enumeration returns all nine objects the same way, with realistic names, ages and attributes, and nothing marks four of them as bait.
Three gaps
Why these attacks go unseen
- The attacks look like normal work
- Requesting a ticket, reading the directory, enrolling for a certificate: every step is something legitimate users do all day. Tools that infer attacks from behavior have to be tuned, and still leave someone deciding which alert is real.
- Certificate services are barely watched
- A misconfigured certificate template can issue a credential for any account in the domain, and exploiting it looks like a certificate being issued. Most security stacks have no coverage here at all.
- Deception has been too heavy to deploy
- Traditional deception tooling requires appliances and collectors, and comes with a price tag that keeps it out of most environments.
The answer
Decoys that only an attacker would touch
Claymore places decoys across your directory: service accounts worth stealing, computer accounts that look neglected, certificate templates that look exploitable. They carry realistic names, ages, and attributes, so an attacker cannot tell them from the real thing.
No employee, application, or scheduled job ever uses them. There is no baseline to learn and no threshold to tune. One interaction is the detection, and your team has the account, source, target, and technique within seconds.
A decoy is touched. Claymore captures five things: the account responsible, the source address, the object targeted, the MITRE technique, and the time. That one detection then splits two ways. It is delivered within seconds to Slack, email, a SIEM, a PSA or any webhook. Separately, if you have switched on automated containment, the account responsible is disabled before anyone has read the alert.
The trigger
A decoy is touched
One interaction is the whole detection.
What Claymore captures
- Account responsible
- CORP\j.doe
- Source address
- 10.14.8.37
- Object targeted
- svc-sql-backup
- Technique
- T1558.003 Kerberoasting
- When it happened
- 14:02:11.4 UTC
Delivered within seconds
- Slack
- SIEM
- PSA
- Webhook
Contained automatically
Optional, on the rules you set
The account responsible is disabled before anyone has read the alert. Privileged accounts are never touched.
What sets it apart
Why Claymore
- Certificate services, covered properlyDecoy templates for seven escalation paths, ESC1 through ESC15. Requests against them are denied as they alert, so nothing is ever issued.
- Every major Active Directory attack pathKerberoasting, AS-REP Roasting, DCSync, Shadow Credentials, RBCD, and pre-2000 accounts, all deployable in seconds.
- One alert, no ambiguityA decoy has no legitimate use, so an interaction is not a signal to investigate. It is the attack.
- Contained in secondsTampered decoys repair themselves, and optional containment disables the account responsible before anyone has read the alert.
- Live in an afternoonOne agent on your domain controllers and certificate authority. No endpoint agents, no appliance, no inbound firewall rule.
- Built for partnersMulti-tenant from the ground up, with isolation enforced in the database and per-client routing to your PSA.
Alongside your stack
Where it fits
Claymore adds to the tools you already run. It covers the identity layer they were not built for.
- Network honeypots
- Decoy hosts and services catch lateral movement, but not Kerberoasting, DCSync, or certificate abuse. Active Directory attacks never touch a decoy host.
- EDR
- EDR watches processes on machines. Identity attacks are valid requests made over the network by a real account, and often run nothing unusual on any host.
- SIEM
- A SIEM can see these attacks if the right sources and rules are in place and maintained. Claymore sends it alerts that need no correlation.
- Microsoft Defender for Identity
- A sensible baseline, and complementary. It does not plant and maintain decoys, cover certificate services deception, or offer a multi-tenant console for providers.
The team
Who builds it
Built by attackers
Claymore is built by offensive security practitioners who compromise enterprise networks under contract. Every decoy is modeled on a path that works in real engagements.
Proven leadership
The team has led engineering and security at major technology and security vendors, and has run hundreds of engagements from small businesses to the Fortune 500.
Deliberately focused
Claymore covers one layer: identity, in Active Directory and certificate services. It is the layer attackers reach for first and defenders instrument last.
Stop tuning. Start catching.
Claymore is delivered through managed service and security partners. Bring it to your clients, or let us connect you with a partner who already runs it.