Catching Credential Guard Off Guard | SO-CON 26
Source: YouTube · SpecterOps · published Jun 4, 2026 · 45:48
BLUF: This presentation details a method to bypass Windows Credential Guard by exploiting Remote Credential Guard to forward and dump credentials from a remote system 0:00.
Key Takeaways:
• The Local Security Authority (LSA) and LSASS process handle Windows authentication, storing credentials in structures like the Logon Session List 0:09.
• Traditional dumping tools like Mimikatz parse LSASS memory, but Microsoft introduced Protected Process Light (PPL) and Credential Guard to block this access 0:14.
• Credential Guard uses Virtualization-Based Security (VBS) to isolate secrets in a secure kernel, preventing direct memory reads of encryption keys 0:24.
• Remote Credential Guard allows secure credential delegation over RDP, but can be manipulated to forward credentials back to an attacker-controlled LSA 0:32.
• The core vulnerability involves implementing a fake Terminal Services SSP to intercept delegated credentials and call the Credential Guard interface to generate crackable NTLMv1 responses or Kerberos tickets 0:35.
The presentation highlights how security features designed to protect credentials can be subverted through protocol exploitation and remote access techniques.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
My name is Waldemar and today I'm going to present you a talk called catching credential guard off guard. Um we are going to be looking at some different topics. Um first of all, I'm going to talk about the authentication module in Windows called the local security authority. Um then I'm going to pivot into how traditional credential dumping works and how tools that we use every day basically function under the hood. Um then I'm going to talk about what Microsoft has introduced to try and kind of defeat these uh these tools that we use every day. And then I'm going to talk about a specific protocol that we can use to circumvent the security feature called remote credential guard and then how we actually do it all of all of this something the pieces. So, the local local security authority i…