How to monitor Windows to prevent credential theft attacks