DumpGuard

DumpGuard DumpGuard is a credential dumping and protocol research tool for modern Windows systems. It abuses the Remote Credential Guard protocol to recover credential material even when Credential Guard is enabled, and also includes a Microsoft v1 authentication package path for session-oriented...

dumpguard_bof

DumpGuard BOF Beacon Object File BOF port of DumpGuard for extracting NTLMv1 hashes from sessions on modern Windows systems. About This Project This repository contains a Beacon Object File BOF implementation of DumpGuard, ported from the original C/.NET implementation to pure C for use with Havo...

BypassCredGuard

BypassCredGuard - Обход Credential Guard через патчинг памяти Wdigest Предыстория Адам Честер @xpn написал статью "Exploring Mimikatz - Part 1 - WDigest" о патчинге памяти для включения UseLogonCredential и принуждения Wdigest кэшировать пароли в открытом виде, которая меня заинтриговала. Модуль...

NativeBypassCredGuard

NativeBypassCredGuard NativeBypassCredGuard — это инструмент, предназначенный для обхода Credential Guard путём патча WDigest.dll с использованием только NTAPI-функций экспортируемых ntdll.dll. Он доступен в двух вариантах: C и C++. Инструмент находит паттерн "39 ?? ?? ?? ?? 00 8b ?? ?? ?? ?? 00"...

lazarus-sigma-rules

Sigma-правила Lazarus Sigma-правила в этом репозитории были созданы командой F-Secure Countercept Detection and Response для обеспечения детектирования инструментов, техник и процедур, недавно использованных группировкой Lazarus. Записи в блоге, посвящённые созданию этих Sigma-правил, можно найти...

CVE-2026-72958

Double free in Windows Credential Guard allows an authorized attacker to elevate privileges locally...

CVE-2026-70578

Heap-based buffer overflow in Windows Credential Guard allows an authorized attacker to elevate privileges locally...

CVE-2026-70578

CVE-2026-70578 is a heap-based buffer overflow in Windows Credential Guard that allows an authorized local attacker to elevate privileges . The Microsoft-assigned CVSS 3.1 score is 7.0 (High) , with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H , indicating local access, high attack complexity,...

EUVD-2026-73655

Heap-based buffer overflow in Windows Credential Guard allows an authorized attacker to elevate privileges locally...

EUVD-2026-73115

Double free in Windows Credential Guard allows an authorized attacker to elevate privileges locally...

CVE-2026-72958

CVE-2026-72958 is a double free vulnerability in Windows Credential Guard that allows an authorized attacker to elevate privileges locally . The flaw resides in the Credential Guard component of Windows, a security feature that isolates user credentials from the rest of the operating system. The ...

Windows Credential Guard Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Credential Guard allows an authorized attacker to elevate privileges locally...

Windows Credential Guard Elevation of Privilege Vulnerability

Double free in Windows Credential Guard allows an authorized attacker to elevate privileges locally...

PT-2026-87873

Name of the Vulnerable Software and Affected Versions Windows Credential Guard affected versions not specified Description A double free issue in Windows Credential Guard allows an authorized attacker to elevate privileges locally. A double free occurs when the system attempts to free the same...

CVE-2026-70578: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Credential Guard allows an authorized attacker to elevate privileges locally...

CVE-2026-72958: Double Free

Double free in Windows Credential Guard allows an authorized attacker to elevate privileges locally...

PT-2026-87813

Name of the Vulnerable Software and Affected Versions Windows Credential Guard affected versions not specified Description A heap-based buffer overflow occurs in Windows Credential Guard, which allows an authorized attacker to elevate privileges locally. A heap-based buffer overflow is a memory...

CVE-2026-64111

A flaw was found in the Linux kernel's Security Module LSM. A local attacker could exploit this vulnerability by leveraging an improper handling of a credential guard mutex in the lsmsetselfattr function. This oversight may allow the attacker to bypass security restrictions enforced by modules su...

CVE-2026-64111 lsm: hold cred_guard_mutex for lsm_set_self_attr()

In the Linux kernel, the following vulnerability has been resolved: lsm: hold credguardmutex for lsmsetselfattr Just as procpidattrwrite already does before calling the LSM hook. This only matters for SELinux and AppArmor which check whether the process is being ptraced and if so, whether to allo...

CVE-2026-64111

The CVE-2026-64111 issue affects the Linux kernel where lsm_set_self_attr() did not hold cred_guard_mutex in the same way as proc_pid_attr_write() before calling the LSM hook. The fix ensures the mutex is held, reducing risk related to SELinux and AppArmor decisions based on whether a process is ...