What we know
Windows service that periodically interacts with pre-existing dummy Active Directory accounts listed in a CSV file and sets up dedicated logs. It supports decoy-account activity without creating the accounts.
Evidence limits
Only repository-described behavior was reviewed; neither service execution nor detection outcomes were verified.
Sources and provenance
- DecoyService repository
Repository documentation · 2026-10-29
Reviewed: 2026-10-29. This record may change when new evidence is found.