Devices with critical credentials should be protected by Credential Guard

Contributed by Robbe Van den Daele with Sam ErdeAll contributors →

Part of Maester · Defender · Exposure Management · All checks

Run this check

Invoke-Maester -TestId MT.1089

Overview

Devices shown in the output are devices where Credential Guard is not enabled or misconfigured, but contains credentials of critical accounts. When critical credentials are stored on devices without Credential Guard enabled, it is easy for adversaries to steal those credentials when the device is compromised. This is because, without Credential Guard enabled, Kerberos, NTLM, and Credential Manager secrets are stored in the Local Security Authority (LSA) process called lsass.exe, which can be dumped with various tools like MimiKatz. With Credential Guard enabled, these secrets are protected and isolated using Virtualization-based security (VBS).

How to fix

Investigate the related devices and the steps that need to be taken in order to enable Credential Guard. This varies depending on operating system, hardware, and device. More information on how Credential Guard works and how it can be configured can be found in this documentation page.

Details

Every attribute of this check

Field	Value
Test ID	MT.1089
Severity	Medium
Suite	Maester
Product	Defender
Feature	Exposure Management
Area	Devices and endpoints
Resource type	Device
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	T1003.001 LSASS Memory
PowerShell test	Test-MtXspmCriticalCredentialsOnNonCredGuardProtectedDevices
Services	Graph
Long running	Yes

Source

• Test: tests/maester/xspm/Test.MT.1089.ps1
• Documentation: tests/maester/xspm/Test.MT.1089.md