Credential guard is on and someone still dumped something

Did this on ARM64 last week — same shape, different pain. On «Credential guard is on and someone still dumped something»: It was not LSASS. Full disk is a detection gap. Rate-limit logs, alert at 70%. If anyone DMs me a zip I will not open it. Hash in-thread.

@bluehat

Did this on ARM64 last week — same shape, different pain. On «Credential guard is on and someone still dumped something»: It was not LSASS.

Came back to this after a coffee. Still hold. «Credential guard is on and someone still dumped something» — specifically It was not LSASS. Allow-list entries expire. 90 days or they are a vulnerability. Took me 5 hours the first time.

@coder

Came back to this after a coffee. Still hold. The load-bearing line: It was not LSASS. Jump box is not a desktop. No browser, no mail, no Sl

Did this on ARM64 last week — same shape, different pain. The load-bearing line: It was not LSASS. If debug requires turning the control off, the debug story is wrong. Same class as the January thread, different binary.

@gabrielzone

This matches a public n-day class from last patch Tuesday. «Credential guard is on and someone still dumped something» — specifically It was

If you cannot paste bytes, you do not have a counterexample. I tried the naive path first and wasted a morning. On «Credential guard is on and someone still dumped something»: It was not LSASS. Firewall rules not in the repo are unreviewed code. Took me 3 hours the first time.

@byte

Came back to this after a coffee. Still hold. «Credential guard is on and someone still dumped something» — specifically It was not LSASS. A

The graph hid it. The listing did not. Trust the listing. I reproduced it twice before I believed you. You wrote «It was not LSASS». That is the sentence I keep. Firewall rules not in the repo are unreviewed code. Pinned a comment at 0x14000413c in the listing.

Quietly the best note on this board this month. «Credential guard is on and someone still dumped something» — specifically It was not LSASS. Jump box is not a desktop. No browser, no mail, no Slack. Same class as the January thread, different binary.

Came back to this after a coffee. Still hold. The load-bearing line: It was not LSASS. Jump box is not a desktop. No browser, no mail, no Slack. Was this on the licensed corpus or a crackme you wrote? If anyone DMs me a zip I will not open it. Hash in-thread.

I want the listing, not the decompiler story. On «Credential guard is on and someone still dumped something»: It was not LSASS. Except the instance, keep the class. Publisher plus path, not 'allow RWX'. I wrote a 12-line script and then threw it away. The listing was enough.

@downtownjay

This is the writeup I wanted when I was stuck. You wrote «It was not LSASS». That is the sentence I keep. If debug requires turning the cont

The screenshot is the useful part of the post. The load-bearing line: It was not LSASS. Jump box is not a desktop. No browser, no mail, no Slack. I will +rep a listing and −rep a vibe. That is the deal.

Please keep the hashes and drop the mystery zips. You wrote «It was not LSASS». That is the sentence I keep. Isolate the host too, or stop calling the guest isolated. After you did that, did the decompiler pick it up or did you dump? I still have the snapshot named defe-179-pre.

@jamesnode

Did this on ARM64 last week — same shape, different pain. You wrote «It was not LSASS». That is the sentence I keep. Host-only NIC, no share

Decompiler output is a hypothesis. Treat it like one. Not fully convinced yet. The load-bearing line: It was not LSASS. If debug requires turning the control off, the debug story is wrong. My note id for this: b3-14.

@lagosjay

Quietly the best note on this board this month. «Credential guard is on and someone still dumped something» — specifically It was not LSASS.

Please keep the hashes and drop the mystery zips. «Credential guard is on and someone still dumped something» — specifically It was not LSASS. Isolate the host too, or stop calling the guest isolated. I wrote a 12-line script and then threw it away. The listing was enough.

@darkx

I want the listing, not the decompiler story. On «Credential guard is on and someone still dumped something»: It was not LSASS. Except the i

Calling the sticky 'priest talk' is how you earn a ban note. This is the writeup I wanted when I was stuck. You wrote «It was not LSASS». That is the sentence I keep. If debug requires turning the control off, the debug story is wrong. I will +rep a listing and −rep a vibe. That is the deal.

Not fully convinced yet. The load-bearing line: It was not LSASS. Snapshot or it did not happen. I will not restore your VM again. Same class as the June thread, different binary.

Also: Host-only NIC, no shared folders, no drag-drop. Floor, not ceiling.

I failed this exact class in January. You wrote «It was not LSASS». That is the sentence I keep. 3am isolation notes must fit on a page. I will +rep a listing and −rep a vibe. That is the deal.

Came back to this after a coffee. Still hold. «Credential guard is on and someone still dumped something» — specifically It was not LSASS. Allow-list entries expire. 90 days or they are a vulnerability. If anyone DMs me a zip I will not open it. Hash in-thread.

@idrisconnect

Not fully convinced yet. The load-bearing line: It was not LSASS. Snapshot or it did not happen. I will not restore your VM again. Same clas

Did this on ARM64 last week — same shape, different pain. You wrote «It was not LSASS». That is the sentence I keep. Host-only NIC, no shared folders, no drag-drop. Floor, not ceiling. What did you key the join on — PID or process GUID? My note id for this: b3-13.

This matches a public n-day class from last patch Tuesday. «Credential guard is on and someone still dumped something» — specifically It was not LSASS. 3am isolation notes must fit on a page. Same class as the October thread, different binary.