Credential Guard: Windows LSA isolation

Credential Guard is a Windows security feature that uses Virtualization-Based Security (VBS) to isolate LSA secrets inside a protected enclave called LSAIso. The Windows LSA isolation prevents NTLM hashes and Kerberos Ticket Granting Tickets (TGTs) from being accessed by processes running in the normal OS environment. Introduced in Windows 10 Enterprise and Windows Server 2016, it relies on the hypervisor to enforce strict memory boundaries between the standard kernel and the isolated LSA process. When Credential Guard is active, credentials are never stored in plain memory accessible to lsass.exe. Tools like Mimikatz that rely on reading LSASS memory directly return empty or unusable results for domain credentials. This protection targets one of the most impactful attack primitives in lateral movement chains: harvesting valid domain credentials from a compromised workstation to pivot across the environment.

Detecting Credential Guard activity and bypass attempts requires monitoring several specific sources. Event ID 14 in the Microsoft-Windows-DeviceGuard operational log confirms that Credential Guard is running. Event ID 3033 or 3063 in the same channel indicates a driver or process attempted to load code that conflicts with VBS policies, which can signal a bypass attempt. On the LSASS side, Sysmon Event ID 10 (ProcessAccess) targeting lsass.exe with rights such as PROCESS_VM_READ (0x0010) or PROCESS_VM_OPERATION (0x0008) should trigger high-priority alerts, even when Credential Guard is enabled, as attackers may attempt fallback techniques. Windows Defender Credential Guard status can also be queried via msinfo32 or the Get-CimInstance Win32_DeviceGuard PowerShell cmdlet. SOC teams should correlate these events with EDR telemetry to catch attempts to load vulnerable drivers (BYOVD) that aim to disable VBS from kernel space before dumping credentials.

Red Team operators face significant constraints when Credential Guard is enabled. Standard Mimikatz sekurlsa::logonpasswords returns no usable NTLM hashes for domain accounts. Cached Kerberos TGTs stored in LSAIso are equally inaccessible. However, several limitations remain exploitable. Credential Guard does not protect local SAM credentials, service account passwords stored in LSA secrets outside the VBS enclave, or credentials cached in memory by third-party applications. DPAPI master keys for the current session may still be accessible. A key Red Team technique involves Bring Your Own Vulnerable Driver (BYOVD): loading a signed but vulnerable kernel driver to disable VBS protections before attempting credential extraction. Tools like KDMapper have been used for this purpose. Hardening against these bypasses requires enforcing HVCI (Hypervisor-Protected Code Integrity) alongside Credential Guard, maintaining a strict driver blocklist via Windows Defender Application Control (WDAC), and auditing any new kernel driver loads through Sysmon Event ID 6.