Credential Guard
 | This article, Credential Guard, has recently been created via the Articles for creation process. Please check to see if the reviewer has accidentally left this template after accepting the draft and take appropriate action as necessary.
Reviewer tools: Inform author |
 | This article may rely excessively on sources too closely associated with the subject, potentially preventing the article from being verifiable and neutral. (November 2018) |
Credential Guard is a virtualization-based isolation technology for LSASS which prevents attackers from stealing credentials that could be used for pass the hash attacks.[1][2][3][4] Credential Guard was introduced with Microsoft's Windows 10 operating system.[1]
Summary
After compromising a system, attackers often attempt to extract any stored credentials for further lateral movement through the network. A prime target is the LSASS process, which stores NTLM and Kerberos credentials. Credential Guard protects LSASS by running it in a virtualized container that even a user with SYSTEM privileges cannot access.[5] The system then creates a proxy process called LSAIso (LSA Isolated) for communication with the virtualized LSASS process.[6][3]
Bypass Techniques
There are several generic techniques for stealing credentials on systems with Credential Guard:
- A keylogger running on the system will capture any typed passwords.[7][3]
- A user with administrator privileges can install a new Security Support Provider (SSP). The new SSP will not be able to access stored password hashes, but will be able to capture all passwords after the SSP is installed.[7][8]
- Extract stored credentials from another source, as is performed in the "Internal Monologue" attack (which uses SSPI to retrieve crackable NetNTLMv1 hashes). [9]
References
- ^ a b "Protect derived domain credentials with Windows Defender Credential Guard". Windows IT Pro Center. Retrieved 14 September 2018.
- ^ "Analysis of the attack surface of windows 10 virtualization-based security" (PDF). blackhat.com. Retrieved 13 November 2018.
- ^ a b c Yosifovich, Pavel; Russinovich, Mark (5 May 2017). Windows Internals, Part 1: System architecture, processes, threads, memory management, and more, Seventh Edition. Microsoft Press. ISBN 978-0-13-398647-1.
- ^ "Credential Guard Cheat Sheet". insights.adaptiva.com. Retrieved 13 November 2018.
- ^ "Deep Dive into Credential Guard, Credential Theft & Lateral Traversal". Microsoft Virtual Academy. Retrieved 17 September 2018.
- ^ "Windows 10 Device Guard and Credential Guard Demystified". Microsoft TechNet, Ash's blog. Retrieved 17 September 2018.
- ^ a b "Windows Credential Guard & Mimikatz". nviso labs. 2018-01-09. Retrieved 14 September 2018.
- ^ "Third party Security Support Providers with Credential Guard". Windows Dev Center. Retrieved 14 September 2018.
- ^ "Retrieving NTLM Hashes without touching LSASS: the "Internal Monologue" Attack". andreafortuna.org. Retrieved 5 November 2018.
Category:Windows 10 Category:Microsoft Windows security technology
| This article, Credential Guard, has recently been created via the Articles for creation process. Please check to see if the reviewer has accidentally left this template after accepting the draft and take appropriate action as necessary.
Reviewer tools: Inform author |