dumpguard_bof

DumpGuard BOF Beacon Object File BOF port of DumpGuard for extracting NTLMv1 hashes from sessions on modern Windows systems. About This Project This repository contains a Beacon Object File BOF implementation of DumpGuard, ported from the original C/.NET implementation to pure C for use with Havo...

DumpGuard

DumpGuard DumpGuard is a credential dumping and protocol research tool for modern Windows systems. It abuses the Remote Credential Guard protocol to recover credential material even when Credential Guard is enabled, and also includes a Microsoft v1 authentication package path for session-oriented...

lazarus-sigma-rules

Reglas Sigma de Lazarus Las reglas Sigma en este repositorio fueron creadas por el equipo de Detección y Respuesta Countercept de F-Secure para proporcionar cobertura de detección para las Herramientas, Técnicas y Procedimientos utilizados recientemente por el Grupo Lazarus. Las publicaciones del...

BypassCredGuard

BypassCredGuard - Bypass de Credential Guard mediante el parcheo de la memoria de Wdigest Antecedentes Adam Chester @xpn escribió un artículo titulado "Exploring Mimikatz - Part 1 - WDigest" sobre el parcheo de memoria para habilitar UseLogonCredential y hacer que Wdigest almacene en caché...

NativeBypassCredGuard

NativeBypassCredGuard NativeBypassCredGuard es una herramienta diseñada para eludir Credential Guard parcheando WDigest.dll utilizando únicamente funciones NTAPI exportadas por ntdll.dll. Está disponible en dos variantes: C y C++. La herramienta localiza el patrón "39 ?? ?? ?? ?? 00 8b ?? ?? ?? ?...

CVE-2026-72958

Double free in Windows Credential Guard allows an authorized attacker to elevate privileges locally...

CVE-2026-70578

Heap-based buffer overflow in Windows Credential Guard allows an authorized attacker to elevate privileges locally...

EUVD-2026-73655

Heap-based buffer overflow in Windows Credential Guard allows an authorized attacker to elevate privileges locally...

CVE-2026-70578

CVE-2026-70578 is a heap-based buffer overflow in Windows Credential Guard that allows an authorized local attacker to elevate privileges . The Microsoft-assigned CVSS 3.1 score is 7.0 (High) , with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H , indicating local access, high attack complexity,...

EUVD-2026-73115

Double free in Windows Credential Guard allows an authorized attacker to elevate privileges locally...

CVE-2026-72958

CVE-2026-72958 is a double free vulnerability in Windows Credential Guard that allows an authorized attacker to elevate privileges locally . The flaw resides in the Credential Guard component of Windows, a security feature that isolates user credentials from the rest of the operating system. The ...

Windows Credential Guard Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Credential Guard allows an authorized attacker to elevate privileges locally...

Windows Credential Guard Elevation of Privilege Vulnerability

Double free in Windows Credential Guard allows an authorized attacker to elevate privileges locally...

CVE-2026-70578: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Credential Guard allows an authorized attacker to elevate privileges locally...

PT-2026-87873

Name of the Vulnerable Software and Affected Versions Windows Credential Guard affected versions not specified Description A double free issue in Windows Credential Guard allows an authorized attacker to elevate privileges locally. A double free occurs when the system attempts to free the same...

PT-2026-87813

Name of the Vulnerable Software and Affected Versions Windows Credential Guard affected versions not specified Description A heap-based buffer overflow occurs in Windows Credential Guard, which allows an authorized attacker to elevate privileges locally. A heap-based buffer overflow is a memory...

CVE-2026-72958: Double Free

Double free in Windows Credential Guard allows an authorized attacker to elevate privileges locally...

CVE-2026-64111

A flaw was found in the Linux kernel's Security Module LSM. A local attacker could exploit this vulnerability by leveraging an improper handling of a credential guard mutex in the lsmsetselfattr function. This oversight may allow the attacker to bypass security restrictions enforced by modules su...

CVE-2026-64111 lsm: hold cred_guard_mutex for lsm_set_self_attr()

In the Linux kernel, the following vulnerability has been resolved: lsm: hold credguardmutex for lsmsetselfattr Just as procpidattrwrite already does before calling the LSM hook. This only matters for SELinux and AppArmor which check whether the process is being ptraced and if so, whether to allo...

CVE-2026-64111

The CVE-2026-64111 issue affects the Linux kernel where lsm_set_self_attr() did not hold cred_guard_mutex in the same way as proc_pid_attr_write() before calling the LSM hook. The fix ensures the mutex is held, reducing risk related to SELinux and AppArmor decisions based on whether a process is ...