<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: detecting-credential-compromise
description: >-
  Detect stolen, leaked, or compromised credentials using breach databases,
  dark web monitoring, behavioral analytics, and IdP risk signals to identify
  and respond to credential compromise before account takeover.
domain: cybersecurity
subdomain: identity-security
tags:
  - credential-compromise
  - breach-detection
  - dark-web-monitoring
  - credential-stuffing
  - haveibeenpwned
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack:
  - T1078
  - T1110
  - T1528
  - T1539
  - T1552
---

# Detecting Credential Compromise

## Overview

Credential compromise is the leading initial access vector. Detection requires
monitoring breach databases, analyzing authentication anomalies, correlating
dark web intelligence, and leveraging IdP risk signals. This technique covers
the full credential compromise detection lifecycle from leak detection through
response and remediation.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Python 3.10+ | Agent tooling |
| SIEM access | Log correlation |
| IdP API access | Identity provider queries |
| `pip install msal` | Microsoft auth library |
| `pip install okta` | Okta SDK |

## Key Concepts

### Credential Compromise Detection Sources

| Source | Signal | Latency |
|---|---|---|
| Breach databases (HIBP) | Known leaked credentials | Hours to days |
| Dark web monitoring | Credentials for sale | Days to weeks |
| IdP risk signals | Anomalous auth patterns | Real-time |
| Behavioral analytics | Deviations from baseline | Minutes |
| Threat intelligence | Campaign-specific IOCs | Hours |

### Detection Logic

```python
COMPROMISE_INDICATORS = {
    "high_confidence": [
        "credential_in_known_breach",
        "password_reuse_across_services",
        "auth_from_known_malicious_ip",
    ],
    "medium_confidence": [
        "impossible_travel_detection",
        "new_device_and_location",
        "off_hours_privileged_access",
    ],
    "low_confidence": [
        "unusual_user_agent",
        "geo_anomaly_minor",
        "session_duration_anomaly",
    ],
}
```

## Workflow

```
1. MONITOR    — Ingest breach databases and dark web feeds
2. CORRELATE  — Match leaked credentials against directory identities
3. DETECT     — Analyze auth patterns for compromise indicators
4. VALIDATE   — Confirm compromise vs. false positive
5. RESPOND    — Force password reset, revoke sessions, notify user
6. HARDEN     — Enforce phishing-resistant MFA, block legacy auth
```

## Verification

```bash
# Validate agent script
python3 -m py_compile scripts/agent.js && echo "OK" || echo "FAIL"
ruff check scripts/agent.js

# Run agent help
node scripts/agent.js --help
```

## References

- [MITRE ATT&CK — Identity Techniques](https://attack.mitre.org/tactics/TA0006/)
- [NIST SP 800-63 Digital Identity Guidelines](https://pages.nist.gov/800-63-3/)
- [NIST SP 800-207 Zero Trust Architecture](https://csrc.nist.gov/publications/detail/sp/800-207/final)
- [CIS Controls v8](https://www.cisecurity.org/controls/v8)
