After an intrusion in which attackers dumped stored credentials and reused them, a team wants an immediate, high-confidence alert the next time anyone tries to use harvested credentials. Which deception technique best meets this goal?
Select an answer to reveal the explanation.
Short Explanation
Plant a fake key where a thief would grab it, and wire an alarm to the lock it opens. Nobody legitimate ever uses that canary account, so the moment you see it sign in, you know someone's working through stolen credentials. Zero false positives is the beauty of it.
Full Explanation
A canary account, a form of honeytoken, is a real-looking account whose credentials are deliberately placed where an attacker harvesting credentials would find them, such as in memory, a configuration file or the directory, but which no legitimate user or service ever uses. Any authentication attempt with it is therefore malicious by definition, giving a high-confidence, low-noise alert at the exact moment harvested credentials are tried. A honeynet is a network of decoy systems that attracts and records attacker activity; it is useful for studying techniques, but an attacker using stolen real credentials against real systems may never touch it, so it does not specifically signal credential reuse. Account lockout after failed attempts slows guessing attacks, yet dumped credentials are valid, so they succeed without generating failures. Rotating service account passwords on a schedule limits how long stolen credentials remain useful, which is a sound mitigation, but it provides no alert when someone attempts to use them. Exam caveat: deception controls are detective, not preventive, so they complement credential hygiene rather than replacing it. Operational check: create the canary account with no group memberships of value, plant its credentials, configure a SIEM rule that alerts on any authentication event for it, and test the rule with a controlled sign-in.