Features
What each capability does, and what it gets you.
Active Directory & Kerberos · 6 techniques
Credential theft
Most intrusions start by stealing one account and climbing from there. Claymore Decoys are built to be the most attractive accounts in the domain, so an attacker finds them first.
Kerberoasting
T1558.003Attackers request service account credentials to crack offline. A Claymore Decoy service account looks like the best target in the domain.
Benefit
You know credentials are being harvested while the attacker is still cracking them.
AS-REP Roasting
T1558.004Some accounts hand out crackable material without a sign-in. A Claymore Decoy carries exactly that weakness.
Benefit
The most tempting account in the domain is the one you planted.
DCSync
T1003.006With enough privilege, an attacker can pose as a domain controller and pull password data. Claymore alerts when that request names a decoy or comes from an account that should never make it.
Benefit
You see the step before a full credential dump, as it happens.
Pre-Windows 2000 accounts
Legacy computer accounts often have passwords guessable from their name. A Claymore Decoy looks like one that was never cleaned up.
Benefit
A technique most tools ignore becomes a named alert.
Shadow Credentials
Attackers attach their own key to an account and sign in as it, no password needed. Claymore catches it on a decoy and can restore the decoy automatically.
Benefit
The attacker’s foothold is gone before anyone has read the alert.
Resource-based delegation (RBCD)
Attackers grant themselves the right to act as other users on a server. A decoy host appears to allow it, and Claymore can revoke the change automatically.
Benefit
The takeover the change was meant to enable never happens.
ADCS · 7 escalation paths
Certificate services abuse
A misconfigured certificate template can mint a sign-in for any account. Claymore publishes templates that look exploitable but cannot be abused. The request is denied or worthless, and you are alerted either way.
ESC1: Enrollee supplies subject
ESC1A template that lets the requester name any user, including a domain admin. The decoy denies every request.
Benefit
You learn your CA is being probed, and no certificate is issued.
ESC2: Any purpose
ESC2A template that issues certificates good for anything, including signing in as someone else.
Benefit
Template enumeration, normally invisible, becomes one attributable event.
ESC3: Enrollment agent
ESC3A template that lets one account request certificates on behalf of others.
Benefit
You see an attacker reaching for every identity in the domain before they have it.
ESC4: Weak template permissions
ESC4A template whose permissions let an attacker rewrite it into something exploitable.
Benefit
A quiet permission change arrives as an alert with a name attached.
ESC9: No security extension
ESC9A template that lets a certificate be mapped onto a different account.
Benefit
Mapping abuse is stopped at the request, where stopping it is free.
ESC13: Issuance policy
ESC13A template that appears to grant membership in a privileged group.
Benefit
Escalation by certificate is caught on the first attempt, not in next year’s access review.
ESC15: Application policy
ESC15An older template that lets the requester add their own application policies, turning it into a sign-in credential.
Benefit
One of the newest published escalation paths, covered and denied.
Response
Automated containment
Optional, and on your terms. When a decoy is tripped, Claymore can disable the account responsible before anyone has read the alert.
Automated containment
When a decoy is tripped, Claymore can disable the account responsible within seconds. Off by default, and enabled decoy by decoy.
Benefit
The attacker loses their account before your team has opened the alert.
Guardrails built in
Privileged accounts, built-in accounts, and domain controllers are never touched automatically. Add your own exclusions, and rehearse in dry-run first.
Benefit
Automation you can switch on without risking your own environment.
Least privilege by design
Containment runs under a separate service account you name, limited to the parts of the directory you choose.
Benefit
Its reach is capped by Active Directory itself, not by our software.
Alerting
Alerting and integrations
Every alert answers who, from where, against what, and how, and arrives wherever your team already works.
Seconds to alert, nothing to tune
Nothing legitimate touches a decoy, so there is no baseline, no threshold, and no learning period.
Benefit
Every alert is worth opening.
Attribution on every alert
Each detection names the account responsible, the source address, the decoy targeted, and the technique.
Benefit
Triage starts with the answer instead of a search.
MITRE ATT&CK mapped
Every detection carries its ATT&CK technique and tactic.
Benefit
Drops straight into your existing coverage reporting.
Alerts where you work
Slack, email, or any webhook endpoint.
Benefit
Nobody has to watch another console.
SIEM, PSA, and API
Splunk, Microsoft Sentinel, or any collector taking OCSF, CEF, or LEEF. ConnectWise, HaloPSA, and Autotask tickets. Full API access.
Benefit
Detections land in the systems you already run, in their native format.
Deployment
Getting it running
Most identity security projects stall at the install. Claymore is live on your domain controllers the afternoon you decide to deploy it.
One lightweight agent
A single self-contained Windows service on your domain controllers and certificate authority. No runtime, no kernel driver, nothing on endpoints.
Benefit
No estate-wide rollout to plan.
One-line install
One PowerShell command per server. The agent registers itself and takes its configuration from the console.
Benefit
A domain controller goes from bare to protected in minutes.
Outbound HTTPS only
Agents connect out on TCP 443. Nothing listens for inbound connections.
Benefit
No new firewall rule and no new listener on a domain controller.
Self-updating
Agents upgrade in place as new coverage ships.
Benefit
New techniques are covered without a maintenance window.
Full requirements are on the What’s Included tab.
Day-two operations
Keeping it working
Environments change. Claymore keeps checking that every decoy still works, and repairs the ones an attacker tampers with.
Continuous decoy verification
Claymore re-checks every decoy against the live directory and flags any that drift out of shape.
Benefit
Coverage that quietly broke shows up on a dashboard, not during an incident.
Agent health
Every agent reports in continuously, with its role, domain, and last check-in.
Benefit
A domain controller that goes silent is visible the same day.
Decoys that repair themselves
When an attacker tampers with a shadow credential or RBCD decoy, Claymore can undo the change and lock the decoy, and records what it did.
Benefit
The attacker’s change is undone in seconds, whoever is on shift.
Tamper-proof history
Detections are stored exactly as captured and cannot be edited. Status, assignee, and notes sit alongside them.
Benefit
The record you hand an auditor or insurer is the original.
MSPs and MSSPs
Built for partners
One console protects every client, with the separation between them enforced where a missed filter cannot break it.
One console, every client
Manage every client from a single dashboard, with views across all of them.
Benefit
A new client is an onboarding step, not another login.
Isolation enforced at the data layer
Each client is isolated by the database itself, not by application filters. Managing a client does not relax that.
Benefit
One client’s data cannot appear in another’s console.
Per-client alert routing
Each client has its own notification channels and destinations.
Benefit
Every client escalates their own way.
Role-based access
Owner, admin, analyst, and viewer roles, per client and across your whole practice.
Benefit
Technicians see the clients they work on and nothing more.
Stop tuning. Start catching.
Claymore is delivered through managed service and security partners. Bring it to your clients, or let us connect you with a partner who already runs it.