A penetration tester is performing post-exploitation on a Windows system and wants to dump credentials from LSASS. The target system has Credential Guard enabled. What is the expected result?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because Credential Guard uses Virtualization-Based Security to move NTLM credential material and Kerberos tickets into an isolated virtual trust level (VSM) that even kernel-level code cannot access, making traditional Mimikatz LSASS dumping ineffective. A is wrong because Credential Guard is specifically designed to prevent this attack; when properly configured, Mimikatz cannot extract these credentials.
Full explanation below image
Full Explanation
B is correct because Credential Guard uses Virtualization-Based Security to move NTLM credential material and Kerberos tickets into an isolated virtual trust level (VSM) that even kernel-level code cannot access, making traditional Mimikatz LSASS dumping ineffective. A is wrong because Credential Guard is specifically designed to prevent this attack; when properly configured, Mimikatz cannot extract these credentials. C is wrong because the SAM database stores local account hashes separately from LSASS secrets protected by Credential Guard; local SAM hashes may still be accessible via other techniques, but domain credential material in VSM is protected. D is wrong because Credential Guard specifically protects domain credentials (NTLM hashes, Kerberos tickets) held in LSASS; it does not protect SAM database hashes.