{
  "technique_id": "T1003",
  "d3fend_mappings": [
    {
      "id": "D3-PSA",
      "name": "Process Spawn Analysis",
      "relationship": "detect",
      "practical_action": "Detect processes opening a handle to lsass.exe outside of known security/monitoring tooling.\n",
      "tooling": [
        "Defender for Endpoint",
        "Sysmon"
      ]
    },
    {
      "id": "D3-FA",
      "name": "File Analysis",
      "relationship": "detect",
      "practical_action": "Detect access to SAM/SYSTEM hives, NTDS.dit, or shadow copies used to extract them.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-KBPI",
      "name": "Kernel-based Process Isolation",
      "relationship": "isolate",
      "practical_action": "Enable Credential Guard / virtualization-based LSASS protection so credential material cannot be read even by a process with local admin.\n",
      "tooling": [
        "Defender for Endpoint",
        "Group Policy"
      ]
    },
    {
      "id": "D3-CR",
      "name": "Credential Revocation",
      "relationship": "evict",
      "practical_action": "Rotate all credentials that may have been present in memory or the dumped store, including the krbtgt account if domain controllers are involved.",
      "tooling": [
        "Entra ID",
        "Active Directory"
      ]
    }
  ]
}