Yep.
...
...
...
When I set up honey pots, they are usually running SSH or FTP, and they usually have default or shit credits on purpose. I do this cuz I don't give a shit about password lists or source IPs... I want to see what scripts they are running and what files they are pulling down to escalate/traverse and what their botnet infra looks like. I might even poke at their infrastructure.
Next, I give it an enticing name, like REGISTER or CONFIDENTIAL or SECRET, so the assholes might bother to manually poke around. Generally, those folks don't find shit. I've been thinking about about throwing in some macro docs to honey badger their asses, but ehhhh, lot of work, and i'm not dumb enough to poke the bear for drivebye shit.
So to summarize, if you think you've just hacked the Gibson with admin:admin, and the hostname is recognizably retarded, and you don't find shit on the endpoint (either user files or useful services running), then rest assured, I have logs that show you're dumb. Errr, I mean, you've found a honey pot.
On IDS... I haven't seen a lot of host-based IDS, just network IDS. In that case, you are not gonna' detect it, because all your network traffic is being replicated to the IDS off the beaten path... that is, IDS generally doesn't sit between you and your target. Instead, it's getting aggregate logs from everywhere. IPS is probably easier to "detect" but I'm gonna' go ahead and let you figure how how/why.
