<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Detecting Credential Dumping

## Key Event IDs

| Event ID | Source | Detection |
|---|---|---|
| Sysmon 10 | Sysmon | ProcessAccess targeting lsass.exe |
| Sysmon 1 | Sysmon | Process creation (reg save, ntdsutil) |
| Sysmon 7 | Sysmon | DLL loaded into lsass |
| 4656 | Security | SAM/SECURITY registry handle request |
| 4662 | Security | DCSync replication GUID access |
| 4769 | Security | Kerberos TGS request (kerberoasting) |
| 4688 | Security | Process creation with command line |

## Access Mask Reference

| Mask | Meaning | Risk |
|---|---|---|
| `0x1010` | PROCESS_QUERY_LIMITED + VM_READ | Medium — memory read |
| `0x1038` | VM_READ + VM_WRITE + VM_OPERATION | High — full memory access |
| `0x1fffff` | PROCESS_ALL_ACCESS | Critical — full control |
| `0x40` | PROCESS_DUP_HANDLE | Medium — handle duplication |

## Agent Script

```bash
# List credential dumping techniques
node agent.js list

# Get technique details
node agent.js get lsass_memory

# Assess detection coverage
node agent.js assess --sources sysmon_eid10 windows_security edr
```
