Windows Credential Guard Related Registry Value Deleted - Registry

Title: Windows Credential Guard Related Registry Value Deleted - Registry
Status: experimental
Description:Detects attempts to disable Windows Credential Guard by deleting registry values. Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Adversaries may disable Credential Guard to gain access to sensitive credentials stored in the system, such as NTLM hashes and Kerberos tickets, which can be used for lateral movement and privilege escalation.
References:
  -https://github.com/DambergC/SaveFolder/blob/90e945eba80fae85f2d54b4616e05a44ec90c500/Cygate%20Installation%20tool%206.22/Script/OSD/OSDeployment-CredentialGuardDisable.ps1#L50
  -https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/configure
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-12-26
modified:None
Tags:

• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• category: registry_delete
• product: windows

Detection:
  selection:
    TargetObject|endswith:
      -'\DeviceGuard\EnableVirtualizationBasedSecurity'
      -'\DeviceGuard\LsaCfgFlags'
      -'\DeviceGuard\RequirePlatformSecurityFeatures'
      -'\Lsa\LsaCfgFlags'

  condition:selection
Falsepositives:
  -Unlikely
Level: high