The term here is a canary, it is a useful deception technique for sure but current approaches to advanced adversaries focus on purple teaming + threat hunting.

The term here is a canary, it is a useful deception technique for sure but current approaches to advanced adversaries focus on purple teaming + threat hunting. They are not mutually exclusive, just pointing out deception tech has been around for a very long time. In a windows network, I highly recommend using honey hashes: https://github.com/EmpireProject/Empire/blob/master/data/module_source/management/New-HoneyHash.ps1 https://github.com/EmpireProject/Empire/blob/master/data/mod... that is if you don't have windows defender credential guard on. My question for the OP is, what happens when acutal users start using the wallet? I wonder if these approaches work at small companies though. In large companies (50k+ endpoints and users) this would be an almost regular source of false positive alerts. I keep an eye out for any new process connecting to a mining pool domain for example, there is always some guy somewhere runing a python trading bot or something.