Catching Credential Guard Off Guard

TL;DR: Specterops demonstrates new techniques to extract credentials from fully patched windows 11 and windows server 2025 systems despite credential guard, by targeting lsa/ssp/sspi interactions.

Context: Credential dumping remains a primary post-exploitation technique. Microsoft introduced Credential Guard to isolate secrets with Virtualization-Based Security (VBS), but public research into practical extraction against Credential Guard has been limited. SpecterOps investigated whether modern protections effectively prevent credential theft in real-world, updated environments.

What’s New: SpecterOps describes a new generation of credential-dumping approaches that differ from classic Mimikatz usage. Rather than relying on a single exploitable bug, the techniques analyze protocol and implementation boundaries between the LSA, Security Support Providers (SSPs), and the SSPI API to surface secrets that cross or appear at isolation boundaries.

Technical Breakdown: The research inspects lsass.exe and lsasrv.dll behavior, focusing on SSPs such as msv1_0.dll (NTLM), kerberos.dll (Kerberos), and the Negotiate broker. Key SSPI flows — obtaining credential handles and establishing security contexts — are mapped to memory and IPC interactions where secrets may be exposed. Tests were performed on Windows 11 workstations and Windows Server 2025.

Detection & Mitigation: Detection emphasis is on anomalous interactions with LSA/SSP components: unusual creation of security contexts, unexpected entity access to lsass.exe, and deviations in authentication flows. Defensive measures should center on tightening privileges for processes that can interact with authentication providers and improving telemetry around SSPI/LSA operations.

Limitations: The work does not disclose a single CVE-based exploit; it highlights protocol and implementation nuances. The validation is limited to the Windows builds specified, and applicability may vary with future OS hardening.

CredentialGuard #Mimikatz #VBS

SOURCE: https://specterops.io/blog/2025/10/23/catching-credential-guard-off-guard/