{
  "node_id": "mitre-d3fend-d3-ccsa-credential-compromise-scope-analysis",
  "title": "MITRE D3FEND D3-CCSA: Credential Compromise Scope Analysis (Defensive Tactic - Detect -> Credential Compromise Scope Analysis)",
  "domain": "Cybersecurity",
  "version": "1.0.0",
  "last_updated": "2026-05-25",
  "bluf": "MITRE D3FEND D3-CCSA (Credential Compromise Scope Analysis) is a Detect defensive technique. Determining which credentials may have been compromised by analyzing the user logon history of a particular system. Memory Credentials may be stored in memory for a variety of reasons; on Windows, they may be stored in lsass.exe. Once a credential dumper like mimikatz runs and dumps the memory of lsass.exe, the credentials of every account logged on since boot are potentially compromised. When such an event occurs, this analytic will give the forensic context to identify compromised users. Those users could potentially be used in later events for additional logons. In the D3FEND model it analyzes the credential. It counters ATT&CK techniques T1003.003, T1003.005, T1003.008, T1098.001, T1110.001, T1110.002, T1110.003, T1134.001, T1134.002, T1134.003, and 10 more. Via the Center for Threat-Informed Defense mapping of the countered techniques, it supports NIST SP 800-53 Rev 5 controls AC-02, AC-03, AC-04, AC-05, AC-06, AC-07, AC-10, AC-16.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "nist_framework",
      "iso_standard",
      "industry_mapping",
      "mitre_d3fend"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "mitre-attack-t1003-003-ntds",
    "mitre-attack-t1003-005-cached-domain-credentials",
    "mitre-attack-t1003-008-etc-passwd-and-etc-shadow",
    "nist-cybersecurity-framework-2-0",
    "nist-sp-800-53-r5",
    "iso-27001-2022"
  ],
  "primary_citations_count": 7
}