Skip to content

Hide Navigation Hide TOC

Windows Credential Guard Disabled - Registry (73921b9c-cafd-4446-b0c6-fdb0ace42bc0)

Detects attempts to disable Windows Credential Guard by setting registry values to 0. Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Adversaries may disable Credential Guard to gain access to sensitive credentials stored in the system, such as NTLM hashes and Kerberos tickets, which can be used for lateral movement and privilege escalation.

Cluster A Galaxy A Cluster B Galaxy B Level
Windows Credential Guard Disabled - Registry (73921b9c-cafd-4446-b0c6-fdb0ace42bc0) Sigma-Rules Disable or Modify Tools - T1562.001 (ac08589e-ee59-4935-8667-d845e38fe579) Attack Pattern 1
Impair Defenses - T1562 (3d333250-30e4-4a82-9edc-756c68afc529) Attack Pattern Disable or Modify Tools - T1562.001 (ac08589e-ee59-4935-8667-d845e38fe579) Attack Pattern 2