Knowledge (XXG)

Credential Guard

Source 📝

2107: 2118: 53:
credentials. Credential Guard prevents attackers from dumping credentials stored in LSASS by running LSASS in a virtualized container that even a user with SYSTEM privileges cannot access. The system then creates a proxy process called LSAIso (LSA Isolated) for communication with the virtualized
406: 69:
A user with administrator privileges can install a new Security Support Provider (SSP). The new SSP will not be able to access stored password hashes, but will be able to capture all passwords after the SSP is
338: 386: 119: 2148: 1122: 45:
After compromising a system, attackers often attempt to extract any stored credentials for further lateral movement through the network. A prime target is the
73:
Extract stored credentials from another source, as is performed in the "Internal Monologue" attack (which uses SSPI to retrieve crackable NetNTLMv1 hashes).
1137: 313: 1302: 379: 46: 23: 959: 346: 209: 234: 1993: 372: 168: 2122: 395: 94: 1372: 1012: 596: 431: 37:
operating system. As of Windows 10 version 20H1, Credential Guard is only available in the Enterprise edition of the operating system.
1544: 1453: 969: 601: 1292: 1272: 1235: 1197: 1182: 2038: 1620: 1147: 1162: 2003: 1872: 1559: 1549: 1423: 1327: 1187: 544: 499: 2111: 1479: 1438: 1337: 1192: 989: 704: 654: 1701: 1581: 1287: 786: 426: 419: 414: 2033: 1998: 1428: 1418: 1357: 1267: 1157: 1127: 776: 474: 161:
Windows Internals, Part 1: System architecture, processes, threads, memory management, and more, Seventh Edition
1398: 1342: 1322: 1167: 936: 821: 711: 1983: 1978: 1822: 1817: 1777: 1737: 1687: 1433: 1177: 1172: 1047: 1022: 984: 954: 904: 716: 639: 564: 484: 459: 184: 89: 87: 1963: 1927: 1539: 1524: 1282: 1240: 1132: 1062: 979: 964: 559: 2092: 1912: 1857: 1797: 1782: 1591: 1262: 1217: 1074: 1027: 287: 152: 2077: 2072: 1917: 1887: 1852: 1742: 1448: 1443: 1347: 1297: 1255: 1225: 1112: 699: 664: 611: 549: 2143: 2018: 1877: 1832: 1807: 1762: 1708: 1507: 1362: 1245: 694: 679: 619: 539: 509: 50: 2023: 1973: 1747: 1666: 1652: 1571: 1277: 1117: 1084: 1057: 1052: 726: 629: 624: 524: 62:
There are several generic techniques for stealing credentials on systems with Credential Guard:
2087: 2013: 1968: 1867: 1862: 1837: 1792: 1757: 1627: 931: 741: 574: 164: 2028: 1937: 1772: 1715: 1673: 1534: 1502: 1458: 1332: 1092: 889: 766: 756: 519: 514: 156: 2064: 1947: 1922: 1907: 1897: 1847: 1842: 1596: 1230: 946: 811: 801: 746: 731: 589: 479: 1554: 1097: 909: 899: 884: 816: 684: 659: 634: 584: 554: 464: 2137: 2043: 1902: 1802: 1142: 1102: 879: 854: 846: 781: 649: 449: 27: 1812: 1767: 1694: 1659: 1367: 1317: 1107: 859: 806: 771: 689: 669: 489: 469: 1882: 1827: 1732: 1586: 1474: 1352: 1207: 999: 974: 569: 339:"Retrieving NTLM Hashes without touching LSASS: the "Internal Monologue" Attack" 364: 1787: 1611: 1152: 1042: 916: 836: 761: 579: 34: 259: 1408: 1403: 1037: 926: 874: 644: 120:"Analysis of the attack surface of windows 10 virtualization-based security" 31: 210:"Deep Dive into Credential Guard, Credential Theft & Lateral Traversal" 95:"Protect derived domain credentials with Windows Defender Credential Guard" 26:
which prevents attackers from stealing credentials that could be used for
1988: 1892: 1752: 1512: 1377: 1007: 864: 751: 736: 674: 534: 494: 282: 280: 2008: 1942: 1680: 1566: 1529: 1517: 1202: 921: 894: 869: 831: 529: 454: 2082: 1932: 1601: 1382: 1307: 66:
A keylogger running on the system will capture any typed passwords.
2048: 1484: 1312: 1017: 791: 504: 1576: 1250: 1069: 1032: 368: 147: 145: 143: 1494: 826: 796: 721: 314:"Third party Security Support Providers with Credential Guard" 235:"Windows 10 Device Guard and Credential Guard Demystified" 2061: 1956: 1725: 1644: 1637: 1610: 1493: 1467: 1391: 1216: 1083: 998: 945: 845: 610: 440: 22:is a virtualization-based isolation technology for 30:attacks. Credential Guard was introduced with 380: 8: 2117: 1641: 387: 373: 365: 288:"Windows Credential Guard & Mimikatz" 83: 2149:Microsoft Windows security technology 1994:Next-Generation Secure Computing Base 7: 1123:Distributed Transaction Coordinator 16:Computer operating system component 1454:User Interface Privilege Isolation 14: 2116: 2106: 2105: 1183:Remote Differential Compression 260:"Technique: Credential Dumping" 49:process, which stores NTLM and 2039:Windows System Assessment Tool 185:"Credential Guard Cheat Sheet" 1: 239:Microsoft TechNet, Ash's blog 1328:Open XML Paper Specification 1188:Remote Installation Services 396:Microsoft Windows components 1480:Windows Subsystem for Linux 1439:Mandatory Integrity Control 1193:Windows Deployment Services 990:Wireless Zero Configuration 2165: 1582:Universal Windows Platform 1288:Kernel Transaction Manager 1273:Hardware Abstraction Layer 970:Multimedia Class Scheduler 2101: 2034:Windows Services for UNIX 1419:Data Execution Prevention 1268:Graphics Device Interface 1158:Network Access Protection 777:Remote Desktop Connection 402: 214:Microsoft Virtual Academy 1399:Security and Maintenance 1343:Security Account Manager 937:Windows XP visual styles 1984:Media Control Interface 1818:Help and Support Center 1434:Kernel Patch Protection 1198:System Resource Manager 1178:Remote Desktop Services 1173:Print Services for UNIX 955:Service Control Manager 565:Windows Error Reporting 485:DirectX Diagnostic Tool 1964:Desktop Cleanup Wizard 1540:COM Structured storage 1241:Desktop Window Manager 1133:Windows Media Services 1592:Windows Mixed Reality 1263:Enhanced Write Filter 1113:Roaming user profiles 189:insights.adaptiva.com 99:Windows IT Pro Center 1873:Mobile Device Center 1823:Health & Fitness 1621:Solitaire Collection 1449:User Account Control 1444:Protected Media Path 1348:Server Message Block 1298:Logical Disk Manager 550:System Policy Editor 535:System Configuration 2019:Virtual DOS machine 1363:System Idle Process 1338:Resource Protection 1246:Portable Executable 1138:Active DRM Services 540:System File Checker 510:Performance Monitor 163:. Microsoft Press. 2024:Windows on Windows 1748:Backup and Restore 1560:Transaction Server 1278:I/O request packet 1118:Folder redirection 787:Speech Recognition 545:System Information 500:Management Console 318:Windows Dev Center 2131: 2130: 2057: 2056: 2014:Video for Windows 1969:Games for Windows 1838:Internet Explorer 932:Windows Spotlight 575:Windows Installer 343:andreafortuna.org 170:978-0-13-398647-1 157:Russinovich, Mark 153:Yosifovich, Pavel 58:Bypass techniques 2156: 2120: 2119: 2109: 2108: 2029:Windows SideShow 1808:Food & Drink 1702:Spider Solitaire 1642: 1535:ActiveX Document 1503:Active Scripting 1459:Windows Firewall 1414:Credential Guard 1093:Active Directory 890:Indexing Service 520:Resource Monitor 515:Recovery Console 389: 382: 375: 366: 359: 358: 356: 354: 345:. Archived from 335: 329: 328: 326: 324: 310: 304: 303: 301: 299: 284: 275: 274: 272: 270: 264:attack.mitre.org 256: 250: 249: 247: 245: 231: 225: 224: 222: 220: 206: 200: 199: 197: 195: 181: 175: 174: 149: 138: 137: 135: 133: 124: 116: 110: 109: 107: 105: 91: 20:Credential Guard 2164: 2163: 2159: 2158: 2157: 2155: 2154: 2153: 2134: 2133: 2132: 2127: 2097: 2065:Microsoft Store 2063: 2053: 1999:POSIX subsystem 1979:File Protection 1952: 1923:Program Manager 1908:Phone Companion 1898:Outlook Express 1848:Make Compatible 1778:Desktop Gadgets 1738:Anytime Upgrade 1721: 1633: 1606: 1597:Windows Runtime 1489: 1463: 1429:Family features 1387: 1212: 1168:DFS Replication 1079: 994: 985:Error Reporting 941: 841: 717:Mobility Center 712:Movies & TV 606: 590:Windows Insider 480:Driver Verifier 475:Drive Optimizer 442: 436: 427:Booting process 398: 393: 363: 362: 352: 350: 337: 336: 332: 322: 320: 312: 311: 307: 297: 295: 286: 285: 278: 268: 266: 258: 257: 253: 243: 241: 233: 232: 228: 218: 216: 208: 207: 203: 193: 191: 183: 182: 178: 171: 151: 150: 141: 131: 129: 122: 118: 117: 113: 103: 101: 93: 92: 85: 80: 60: 54:LSASS process. 43: 17: 12: 11: 5: 2162: 2160: 2152: 2151: 2146: 2136: 2135: 2129: 2128: 2126: 2125: 2114: 2102: 2099: 2098: 2096: 2095: 2090: 2085: 2080: 2075: 2069: 2067: 2059: 2058: 2055: 2054: 2052: 2051: 2046: 2041: 2036: 2031: 2026: 2021: 2016: 2011: 2006: 2001: 1996: 1991: 1986: 1981: 1976: 1971: 1966: 1960: 1958: 1954: 1953: 1951: 1950: 1945: 1940: 1935: 1930: 1928:Steps Recorder 1925: 1920: 1915: 1910: 1905: 1900: 1895: 1890: 1885: 1880: 1875: 1870: 1865: 1860: 1855: 1850: 1845: 1840: 1835: 1830: 1825: 1820: 1815: 1810: 1805: 1800: 1795: 1790: 1785: 1780: 1775: 1770: 1765: 1760: 1755: 1750: 1745: 1740: 1735: 1729: 1727: 1723: 1722: 1720: 1719: 1712: 1705: 1698: 1691: 1684: 1677: 1670: 1663: 1656: 1648: 1646: 1639: 1635: 1634: 1632: 1631: 1624: 1616: 1614: 1608: 1607: 1605: 1604: 1599: 1594: 1589: 1584: 1579: 1574: 1569: 1564: 1563: 1562: 1557: 1555:OLE Automation 1552: 1547: 1542: 1537: 1532: 1522: 1521: 1520: 1515: 1510: 1499: 1497: 1491: 1490: 1488: 1487: 1482: 1477: 1471: 1469: 1465: 1464: 1462: 1461: 1456: 1451: 1446: 1441: 1436: 1431: 1426: 1421: 1416: 1411: 1406: 1401: 1395: 1393: 1389: 1388: 1386: 1385: 1380: 1375: 1370: 1365: 1360: 1355: 1350: 1345: 1340: 1335: 1330: 1325: 1323:Object Manager 1320: 1315: 1310: 1305: 1300: 1295: 1290: 1285: 1283:Imaging Format 1280: 1275: 1270: 1265: 1260: 1259: 1258: 1253: 1243: 1238: 1233: 1228: 1222: 1220: 1214: 1213: 1211: 1210: 1205: 1200: 1195: 1190: 1185: 1180: 1175: 1170: 1165: 1160: 1155: 1150: 1145: 1140: 1135: 1130: 1125: 1120: 1115: 1110: 1105: 1100: 1095: 1089: 1087: 1081: 1080: 1078: 1077: 1072: 1067: 1066: 1065: 1060: 1055: 1050: 1045: 1040: 1030: 1025: 1020: 1015: 1010: 1004: 1002: 996: 995: 993: 992: 987: 982: 980:Task Scheduler 977: 972: 967: 962: 957: 951: 949: 943: 942: 940: 939: 934: 929: 924: 919: 914: 913: 912: 910:Special folder 907: 902: 897: 892: 882: 877: 872: 867: 862: 857: 851: 849: 843: 842: 840: 839: 834: 829: 824: 822:Voice Recorder 819: 814: 809: 804: 799: 794: 789: 784: 779: 774: 769: 764: 759: 754: 749: 744: 739: 734: 729: 724: 719: 714: 709: 708: 707: 697: 692: 687: 682: 677: 672: 667: 662: 657: 652: 647: 642: 637: 632: 627: 622: 616: 614: 608: 607: 605: 604: 599: 594: 593: 592: 585:Windows Update 582: 577: 572: 567: 562: 557: 555:System Restore 552: 547: 542: 537: 532: 527: 522: 517: 512: 507: 502: 497: 492: 487: 482: 477: 472: 467: 465:Device Manager 462: 457: 455:Command Prompt 452: 446: 444: 438: 437: 435: 434: 429: 424: 423: 422: 417: 409: 403: 400: 399: 394: 392: 391: 384: 377: 369: 361: 360: 349:on 26 May 2018 330: 305: 276: 251: 226: 201: 176: 169: 159:(5 May 2017). 139: 111: 82: 81: 79: 76: 75: 74: 71: 67: 59: 56: 42: 39: 15: 13: 10: 9: 6: 4: 3: 2: 2161: 2150: 2147: 2145: 2142: 2141: 2139: 2124: 2115: 2113: 2104: 2103: 2100: 2094: 2091: 2089: 2086: 2084: 2081: 2079: 2076: 2074: 2071: 2070: 2068: 2066: 2060: 2050: 2047: 2045: 2044:Windows To Go 2042: 2040: 2037: 2035: 2032: 2030: 2027: 2025: 2022: 2020: 2017: 2015: 2012: 2010: 2007: 2005: 2002: 2000: 1997: 1995: 1992: 1990: 1987: 1985: 1982: 1980: 1977: 1975: 1972: 1970: 1967: 1965: 1962: 1961: 1959: 1955: 1949: 1946: 1944: 1941: 1939: 1936: 1934: 1931: 1929: 1926: 1924: 1921: 1919: 1916: 1914: 1913:Photo Gallery 1911: 1909: 1906: 1904: 1901: 1899: 1896: 1894: 1891: 1889: 1886: 1884: 1881: 1879: 1876: 1874: 1871: 1869: 1866: 1864: 1861: 1859: 1858:Meeting Space 1856: 1854: 1851: 1849: 1846: 1844: 1841: 1839: 1836: 1834: 1831: 1829: 1828:HyperTerminal 1826: 1824: 1821: 1819: 1816: 1814: 1811: 1809: 1806: 1804: 1801: 1799: 1798:Easy Transfer 1796: 1794: 1791: 1789: 1786: 1784: 1781: 1779: 1776: 1774: 1771: 1769: 1766: 1764: 1761: 1759: 1756: 1754: 1751: 1749: 1746: 1744: 1741: 1739: 1736: 1734: 1731: 1730: 1728: 1724: 1718: 1717: 1713: 1711: 1710: 1706: 1704: 1703: 1699: 1697: 1696: 1692: 1690: 1689: 1685: 1683: 1682: 1678: 1676: 1675: 1671: 1669: 1668: 1664: 1662: 1661: 1657: 1655: 1654: 1650: 1649: 1647: 1643: 1640: 1636: 1630: 1629: 1625: 1623: 1622: 1618: 1617: 1615: 1613: 1609: 1603: 1600: 1598: 1595: 1593: 1590: 1588: 1585: 1583: 1580: 1578: 1575: 1573: 1570: 1568: 1565: 1561: 1558: 1556: 1553: 1551: 1548: 1546: 1543: 1541: 1538: 1536: 1533: 1531: 1528: 1527: 1526: 1523: 1519: 1516: 1514: 1511: 1509: 1506: 1505: 1504: 1501: 1500: 1498: 1496: 1492: 1486: 1483: 1481: 1478: 1476: 1473: 1472: 1470: 1468:Compatibility 1466: 1460: 1457: 1455: 1452: 1450: 1447: 1445: 1442: 1440: 1437: 1435: 1432: 1430: 1427: 1425: 1422: 1420: 1417: 1415: 1412: 1410: 1407: 1405: 1402: 1400: 1397: 1396: 1394: 1390: 1384: 1381: 1379: 1376: 1374: 1371: 1369: 1366: 1364: 1361: 1359: 1356: 1354: 1351: 1349: 1346: 1344: 1341: 1339: 1336: 1334: 1331: 1329: 1326: 1324: 1321: 1319: 1316: 1314: 1311: 1309: 1306: 1304: 1301: 1299: 1296: 1294: 1293:Library files 1291: 1289: 1286: 1284: 1281: 1279: 1276: 1274: 1271: 1269: 1266: 1264: 1261: 1257: 1254: 1252: 1249: 1248: 1247: 1244: 1242: 1239: 1237: 1234: 1232: 1229: 1227: 1224: 1223: 1221: 1219: 1215: 1209: 1206: 1204: 1201: 1199: 1196: 1194: 1191: 1189: 1186: 1184: 1181: 1179: 1176: 1174: 1171: 1169: 1166: 1164: 1161: 1159: 1156: 1154: 1151: 1149: 1146: 1144: 1141: 1139: 1136: 1134: 1131: 1129: 1126: 1124: 1121: 1119: 1116: 1114: 1111: 1109: 1106: 1104: 1101: 1099: 1096: 1094: 1091: 1090: 1088: 1086: 1082: 1076: 1073: 1071: 1068: 1064: 1061: 1059: 1056: 1054: 1053:Reparse point 1051: 1049: 1046: 1044: 1041: 1039: 1036: 1035: 1034: 1031: 1029: 1026: 1024: 1021: 1019: 1016: 1014: 1011: 1009: 1006: 1005: 1003: 1001: 997: 991: 988: 986: 983: 981: 978: 976: 973: 971: 968: 966: 963: 961: 958: 956: 953: 952: 950: 948: 944: 938: 935: 933: 930: 928: 925: 923: 920: 918: 915: 911: 908: 906: 903: 901: 898: 896: 893: 891: 888: 887: 886: 883: 881: 878: 876: 873: 871: 868: 866: 863: 861: 858: 856: 855:Action Center 853: 852: 850: 848: 844: 838: 835: 833: 830: 828: 825: 823: 820: 818: 815: 813: 810: 808: 805: 803: 800: 798: 795: 793: 790: 788: 785: 783: 782:Snipping Tool 780: 778: 775: 773: 770: 768: 765: 763: 760: 758: 755: 753: 750: 748: 745: 743: 740: 738: 735: 733: 730: 728: 725: 723: 720: 718: 715: 713: 710: 706: 703: 702: 701: 698: 696: 693: 691: 688: 686: 683: 681: 678: 676: 673: 671: 668: 666: 663: 661: 658: 656: 653: 651: 648: 646: 643: 641: 640:Character Map 638: 636: 633: 631: 628: 626: 623: 621: 618: 617: 615: 613: 609: 603: 600: 598: 595: 591: 588: 587: 586: 583: 581: 578: 576: 573: 571: 568: 566: 563: 561: 558: 556: 553: 551: 548: 546: 543: 541: 538: 536: 533: 531: 528: 526: 523: 521: 518: 516: 513: 511: 508: 506: 503: 501: 498: 496: 493: 491: 488: 486: 483: 481: 478: 476: 473: 471: 468: 466: 463: 461: 460:Control Panel 458: 456: 453: 451: 450:App Installer 448: 447: 445: 439: 433: 430: 428: 425: 421: 418: 416: 413: 412: 411:Architecture 410: 408: 405: 404: 401: 397: 390: 385: 383: 378: 376: 371: 370: 367: 348: 344: 340: 334: 331: 319: 315: 309: 306: 293: 289: 283: 281: 277: 265: 261: 255: 252: 240: 236: 230: 227: 215: 211: 205: 202: 190: 186: 180: 177: 172: 166: 162: 158: 154: 148: 146: 144: 140: 128: 121: 115: 112: 100: 96: 90: 88: 84: 77: 72: 68: 65: 64: 63: 57: 55: 52: 48: 40: 38: 36: 33: 29: 28:pass the hash 25: 21: 2078:File Manager 1918:Photo Viewer 1853:Media Center 1813:Groove Music 1743:Address Book 1714: 1707: 1700: 1695:Purble Place 1693: 1686: 1679: 1672: 1665: 1660:Chess Titans 1658: 1651: 1638:Discontinued 1626: 1619: 1413: 1318:Ntoskrnl.exe 1226:Boot Manager 1218:Architecture 1108:Group Policy 1000:File systems 900:Saved search 807:Sticky Notes 772:Quick Assist 700:Media Player 670:Feedback Hub 665:Fax and Scan 560:Task Manager 490:Event Viewer 470:Disk Cleanup 351:. Retrieved 347:the original 342: 333: 323:14 September 321:. Retrieved 317: 308: 298:14 September 296:. Retrieved 294:. 2018-01-09 291: 267:. Retrieved 263: 254: 244:17 September 242:. Retrieved 238: 229: 219:17 September 217:. Retrieved 213: 204: 192:. Retrieved 188: 179: 160: 130:. Retrieved 127:blackhat.com 126: 114: 104:14 September 102:. Retrieved 98: 61: 44: 19: 18: 2093:Minesweeper 2062:Spun off to 1883:MSN Dial-up 1878:Movie Maker 1783:Diagnostics 1733:ActiveMovie 1475:COMMAND.COM 1353:Shadow Copy 1208:Server Core 1048:Mount Point 975:Shadow Copy 570:Windows Ink 194:13 November 132:13 November 32:Microsoft's 2144:Windows 10 2138:Categories 2073:DVD Player 1888:NetMeeting 1788:DriveSpace 1653:3D Pinball 1153:SharePoint 917:Start menu 762:Phone Link 625:Calculator 580:PowerShell 441:Management 353:5 November 292:nviso labs 78:References 70:installed. 35:Windows 10 1868:Messenger 1863:Messaging 1793:DVD Maker 1763:CD Player 1758:CardSpace 1709:Solitaire 1409:BitLocker 1404:AppLocker 1038:Hard link 927:Task View 905:Namespace 875:ClearType 695:Messaging 680:Magnifier 645:Clipchamp 620:3D Viewer 2112:Category 1989:MS-DOS 7 1974:ScanDisk 1893:NTBackup 1773:Contacts 1753:Cardfile 1688:Hold 'Em 1667:FreeCell 1513:VBScript 1424:Defender 1392:Security 1378:Winlogon 1333:Registry 947:Services 880:Explorer 865:AutoPlay 752:Paint 3D 737:OneDrive 727:Narrator 675:Get Help 630:Calendar 525:Settings 495:IExpress 51:Kerberos 2088:Mahjong 2009:Interix 1943:WinHelp 1843:Journal 1833:Imaging 1681:InkBall 1567:DirectX 1530:ActiveX 1518:JScript 1231:Console 1203:Hyper-V 1098:Domains 922:Taskbar 895:IFilter 870:AutoRun 832:WordPad 827:Weather 742:OneNote 732:Notepad 655:Cortana 530:Sysprep 41:Summary 2121:  2110:  2083:Hover! 1957:Others 1938:Travel 1933:Syskey 1716:Tinker 1674:Hearts 1602:WinUSB 1587:WinAPI 1572:Native 1383:WinUSB 1308:MinWin 1085:Server 885:Search 797:Sports 767:Photos 757:People 635:Camera 269:8 July 167:  2049:WinFS 1948:Write 1645:Games 1612:Games 1485:WoW64 1313:NTLDR 1303:LSASS 1236:CSRSS 1043:links 1018:exFAT 847:Shell 812:Store 802:Start 792:Skype 747:Paint 722:Money 650:Clock 597:WinRE 505:Netsh 443:tools 432:Games 123:(PDF) 47:LSASS 24:LSASS 2123:List 2004:HPFS 1768:Chat 1726:Apps 1628:Surf 1577:.NET 1545:DCOM 1373:WHEA 1368:USER 1358:SMSS 1148:WSUS 1128:MSMQ 1070:ReFS 1033:NTFS 1008:CDFS 965:CLFS 960:BITS 860:Aero 837:Xbox 817:Tips 705:2022 690:Maps 685:Mail 660:Edge 612:Apps 407:APIs 355:2018 325:2018 300:2018 271:2019 246:2018 221:2018 196:2018 165:ISBN 134:2018 106:2018 1903:Pay 1803:Fax 1550:OLE 1525:COM 1508:WSH 1495:API 1256:DLL 1251:EXE 1163:PWS 1143:IIS 1103:DNS 1075:UDF 1063:EFS 1058:TxF 1028:FAT 1023:IFS 1013:DFS 602:WMI 2140:: 420:NT 415:9x 341:. 316:. 290:. 279:^ 262:. 237:. 212:. 187:. 155:; 142:^ 125:. 97:. 86:^ 388:e 381:t 374:v 357:. 327:. 302:. 273:. 248:. 223:. 198:. 173:. 136:. 108:.

Index

LSASS
pass the hash
Microsoft's
Windows 10
LSASS
Kerberos


"Protect derived domain credentials with Windows Defender Credential Guard"
"Analysis of the attack surface of windows 10 virtualization-based security"



Yosifovich, Pavel
Russinovich, Mark
ISBN
978-0-13-398647-1
"Credential Guard Cheat Sheet"
"Deep Dive into Credential Guard, Credential Theft & Lateral Traversal"
"Windows 10 Device Guard and Credential Guard Demystified"
"Technique: Credential Dumping"


"Windows Credential Guard & Mimikatz"
"Third party Security Support Providers with Credential Guard"
"Retrieving NTLM Hashes without touching LSASS: the "Internal Monologue" Attack"
the original
v
t
e

Text is available under the Creative Commons Attribution-ShareAlike License. Additional terms may apply.