The purpose of aThreat Defense for Active Directory Deceptive Accountis toexpose attackers as they attempt to gather credential information from workstation memory. These deceptive accounts are crafted to resemble legitimate credentials but are, in fact, traps that alert administrators to malicious activity. When an attacker attempts to access these deceptive credentials, it indicates potential unauthorized efforts to harvest credentials, allowing security teams to detect and respond to these intrusions proactively.
SES Complete Documentationexplains the use of deceptive accounts as part of a proactive defense strategy, where false credentials are seeded in vulnerable areas to catch and track attacker movements within the network.