US Patent 10986124 Baiting endpoints for improved detection of authentication attacks

A credential store for an endpoint contains credentials for accessing a remote service. In general, the credentials will not have an ordinary, legitimate use for the endpoint, serving instead to log in to a dedicated trapping service or the like. In the event that the endpoint becomes compromised and an attacker gains access to the credential store, the presentation of the credentials to the remote service can provide an indication of compromise to the endpoint and any suitable remediation may be taken.