<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-credential-theft-on-endpoints
description: >-
  Detect and prevent credential theft techniques including LSASS access,
  credential dumping, Kerberoasting, DCSync, and pass-the-hash attacks.
  Covers protective controls, detection rules, and response procedures.
domain: cybersecurity
subdomain: endpoint-security
tags:
  - credential-theft
  - lsass
  - mimikatz
  - kerberoasting
  - dcsync
  - pass-the-hash
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack:
    - T1003.001
    - T1003.006
    - T1558.003
    - T1550.002
---

# Detecting Credential Theft on Endpoints

## Overview

Credential theft is a critical phase in most attack chains, enabling lateral
movement and privilege escalation. Detection focuses on LSASS memory access
patterns, suspicious authentication events, and Kerberos anomalies. Protective
controls include Credential Guard, LSA protection, and privileged access management.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Sysmon | Process access monitoring (EID 10) for LSASS detection |
| Windows Event Logs | Security log (EID 4624, 4625, 4672, 4768, 4769) |
| Credential Guard | Virtualization-based LSASS isolation |
| EDR platform | Behavioral detection of credential access tools |

## Workflow

1. **Enable LSASS protection** — Configure RunAsPPL and Credential Guard
2. **Deploy Sysmon rules** — Monitor ProcessAccess to lsass.exe (EID 10)
3. **Configure audit policy** — Enable Kerberos authentication and service ticket logging
4. **Write detection rules** — Sigma rules for known credential theft patterns
5. **Baseline LSASS access** — Document legitimate processes that access LSASS
6. **Hunt for anomalies** — Query for unusual LSASS access patterns
7. **Monitor DCSync** — Detect Directory Replication Service requests from non-DCs
8. **Alert and respond** — Isolate endpoint, rotate credentials on detection

## Key Commands

```powershell
# Enable LSASS PPL protection
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL /t REG_DWORD /d 1 /f

# Enable Credential Guard
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 1 /f

# Query LSASS access events (Sysmon EID 10)
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational';Id=10} |
  Where-Object { $_.Properties[8].Value -like '*lsass*' }

# Detect Kerberoasting (EID 4769 with RC4 encryption)
Get-WinEvent -FilterHashtable @{LogName='Security';Id=4769} |
  Where-Object { $_.Properties[5].Value -eq '0x17' }

# Detect DCSync (EID 4662 — DS-Replication-Get-Changes)
Get-WinEvent -FilterHashtable @{LogName='Security';Id=4662} |
  Where-Object { $_.Message -match '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2' }

# Check Credential Guard status
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard
```

## Verification

| Check | Method |
|---|---|
| LSASS PPL enabled | `RunAsPPL` registry value is 1 |
| Credential Guard active | `Win32_DeviceGuard` shows VBS running |
| Sysmon EID 10 logging | LSASS access events present in Sysmon log |
| Kerberoasting detection | EID 4769 with RC4 encryption type triggers alert |
| DCSync detection | EID 4662 with replication GUID from non-DC triggers alert |

## References

- [MITRE ATT&CK — OS Credential Dumping](https://attack.mitre.org/techniques/T1003/)
- [Microsoft — Credential Guard](https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/)
- [LSASS Protection](https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection)

---
v1.0 | Validated: 2026-03-18
