Windows Credential Guard Disabled - Registry

Hunt Hypothesis

Detects attempts to disable Windows Credential Guard by setting registry values to 0. Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can

Detection Rule

Sigma (Original)

title: Windows Credential Guard Disabled - Registry
id: 73921b9c-cafd-4446-b0c6-fdb0ace42bc0
related:
    - id: c17d47b7-dcd6-4109-87eb-d1817bd4cbc9
      type: similar
status: experimental
description: |
    Detects attempts to disable Windows Credential Guard by setting registry values to 0. Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them.
    Adversaries may disable Credential Guard to gain access to sensitive credentials stored in the system, such as NTLM hashes and Kerberos tickets, which can be used for lateral movement and privilege escalation.
references:
    - https://woshub.com/disable-credential-guard-windows/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-12-26
tags:
    - attack.defense-evasion
    - attack.t1562.001
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith:
            - '\DeviceGuard\EnableVirtualizationBasedSecurity'
            - '\DeviceGuard\LsaCfgFlags'
            - '\Lsa\LsaCfgFlags'
        Details: 'DWORD (0x00000000)'
    condition: selection
falsepositives:
    - Unlikely
level: high
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_credential_guard_disabled/info.yml

KQL (Azure Sentinel)

imRegistry
| where (RegistryKey endswith "\\DeviceGuard\\EnableVirtualizationBasedSecurity" or RegistryKey endswith "\\DeviceGuard\\LsaCfgFlags" or RegistryKey endswith "\\Lsa\\LsaCfgFlags") and RegistryValueData =~ "DWORD (0x00000000)"

KQL (Microsoft 365 Defender)

DeviceRegistryEvents
| where (RegistryKey endswith "\\DeviceGuard\\EnableVirtualizationBasedSecurity" or RegistryKey endswith "\\DeviceGuard\\LsaCfgFlags" or RegistryKey endswith "\\Lsa\\LsaCfgFlags") and RegistryValueData =~ "DWORD (0x00000000)"

Required Data Sources

False Positive Guidance

• Unlikely

MITRE ATT&CK Context

• Tactic: Defense Evasion
• Technique: T1562.001 — T1562.001

References

• https://woshub.com/disable-credential-guard-windows/
• SigmaHQ Rule