In Microsoft Defender XDR Deception, lures (also known as decoy files) are strategically planted within endpoints to attract attackers and detect credential theft or lateral movement attempts. When configuring a custom lure, you must align the file type and planting path with the operating system environment of the targeted devices.

Since the environment in this question includes Windows 11 and Linux CentOS devices, the chosen configuration must be valid across both OS types. The BIN file type is a binary executable type commonly recognized on Linux systems (for example, *.bin files) and supported by the deception engine for non-Windows environments. Microsoft documentation for Defender Deception specifies that BIN files are the appropriate lure type for Linux-based devices, whereas EXE or LNK files are specific to Windows-only deception scenarios.

For the planting path, {HOME} is the correct choice. Defender Deception automatically resolves {HOME} to the user’s home directory, which is a standard, writable, and expected location across both Windows (C:\Users<username>) and Linux (/home/<username>) environments. This ensures consistent deployment and operation of the lure without requiring administrative customization of shared or temporary directories.

Therefore, to meet cross-platform coverage and minimal configuration effort:

✅ File type: BIN

✅ Planting path: {HOME}