What is the purpose of a Threat Defense for Active Directory Deceptive Account?

The purpose of a Threat Defense for Active Directory Deceptive Account is to expose attackers as

they attempt to gather credential information from workstation memory. These deceptive accounts

are crafted to resemble legitimate credentials but are, in fact, traps that alert administrators to

malicious activity. When an attacker attempts to access these deceptive credentials, it indicates

potential unauthorized efforts to harvest credentials, allowing security teams to detect and respond

to these intrusions proactively.

SES Complete Documentation explains the use of deceptive accounts as part of a proactive defense

strategy, where false credentials are seeded in vulnerable areas to catch and track attacker

movements within the network.