What is a canary account?
A canary account is a fake identity planted in a directory such as Active Directory or a cloud identity provider. It looks like a real account, often one an attacker would want, such as an old service account or an administrator with a plausible name, but it holds no real privileges and nothing legitimate ever uses it. Since no authentication is ever expected, any logon attempt, ticket request or password guess against it is an alert. The name comes from the canary miners carried as an early warning. SY0-801 added canary accounts to its deception material.
What a canary account detects
| Attacker activity | What the canary shows | Typical Windows events |
|---|---|---|
| Password spraying or brute force across every account | Failed logons for an account nobody uses | 4625, 4771 for failed Kerberos pre-authentication, or 4776 for failed NTLM validation on a domain controller |
| Use of a fake password planted in an old script or saved connection | A successful logon or ticket request | 4624 or 4768 |
| Kerberoasting, when the canary has a service principal name (SPN) | A service ticket requested for the canary | 4769 |
| Directory enumeration that reads every account | Reads of the account object, if directory auditing covers it | 4662 |
Building a believable canary
- Name it to fit local conventions, such as svc-backup-legacy or adm-pnguyen, with a plausible description.
- Let it age. An account created yesterday with no logon history looks wrong to a careful intruder.
- Give it a long random password, or plant a fake one where an intruder will find it, depending on what it should catch.
- Grant no real rights. Adding it to a privileged group to look attractive turns a detector into a backdoor.
- Exclude it from credentialed scans, identity sync jobs and other processes that touch every account, or they will raise false alarms.
Example detection rule
With no normal activity to filter out, the rule is short. In a SIEM it might read:
(EventID IN (4624,4625,4768,4771,4776) AND TargetUserName="svc-backup-legacy") OR (EventID=4769 AND ServiceName="svc-backup-legacy")
The second clause matters because a Kerberoasting request names the canary as the service, not as the user. The event's client address, or the workstation name in 4776, shows which host to investigate. Test the rule each quarter with a deliberate logon, so a renamed field or a broken log forwarder can't silence it unnoticed.
Canary account vs. honeytoken and break-glass account
- Honeytoken: fake data, such as an API key or database record. Vendors sometimes call a fake credential a honeytoken too; when the bait is an account object in a directory, the exam term is canary account.
- Break-glass account: a real emergency access account that must work when normal sign-in fails. It is also rarely used and closely watched, but its use can be legitimate, while a canary's never is.
Canary account on the CompTIA Security+ exam
Canary accounts are new in SY0-801 and sit with the other deception and disruption tools under objective 4.1. Wording such as a decoy account no one should use, alerting on any authentication attempt for a fake user, or catching password spraying or Kerberoasting without signatures points here. Decide by what was planted: an account in a directory is a canary account, data is a honeytoken, a document is a honeyfile and a system is a honeypot. Distractors include account lockout, which reacts to failures on real accounts, and a break-glass account, which is real and has to work. A canary detects the attack it reveals; it doesn't prevent it.