<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Detecting Credential Theft on Endpoints

## Credential Theft Detection APIs

### Windows Security Events

| Event ID | Description |
|---|---|
| 4624 | Successful logon (Type 3 = network, Type 9 = new credentials) |
| 4625 | Failed logon attempt |
| 4648 | Explicit credential logon (runas) |
| 4662 | Directory service object access (DCSync detection) |
| 4672 | Special privileges assigned (admin logon) |
| 4768 | Kerberos TGT request (AS-REQ) |
| 4769 | Kerberos service ticket request (TGS-REQ) |

### Sysmon Events

| Event ID | Description |
|---|---|
| 10 | ProcessAccess — LSASS access detection |
| 1 | Process creation — credential tool execution |
| 8 | CreateRemoteThread — injection into LSASS |

### Agent Script

```bash
# Check LSASS PPL protection
node agent.js check-ppl

# Check Credential Guard
node agent.js check-credguard

# Scan LSASS access events
node agent.js scan-lsass --max-events 100
```
