home.social

#tgts — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #tgts, aggregated by home.social.

  1. 18. Drive

    I am a bit behind, part of because I‘m preparing for an exhibition opening this week. I‘ll be back on track in a few days! You can see more on karolinamalwina.net (it‘s a whole different world there)

    #comic #comicartist #cartoon #cartoonist #drawing #sketch #autobiocomics #cartoonsrtist #procreate #tgts #comicart #comicsofinstagram #webcomic #zeichnung #inktober #inking #challenge @inktober #comictober #drive

  2. Popular methods of #lateral #movement that threat actors use within #ActiveDirectory include #pass-the-hash or #pass-the-ticket. More on these attacks next time. But do you know how to defend against them?

    Defense isn't exactly easy, but Windows Hello for Business (#WHfB), which I've written about before, can help. Or #Windows #Defender #Credential #Guard, which I'll be writing about today.

    Windows Defender Credential Guard uses virtualization-based security (#VBS) to isolate secrets such as #NTLM password hashes, #Kerberos #TGTs, or domain credentials stored by applications so that only a privileged system can access these secrets.

    With Windows Defender Credential Guard enabled, the LSA process in the operating system talks to a new component called the isolated #LSA process that stores and protects those secrets. Data stored by the isolated LSA process is protected using virtualization-based security and isn't accessible to the rest of the operating system. LSA uses remote procedure calls to communicate with the isolated LSA process.

    When Windows Defender Credential Guard is enabled, NTLMv1, MS-CHAPv2, Digest, and CredSSP can't use the signed-in credentials. Thus, single sign-on doesn't work with these protocols. And Kerberos doesn't allow unconstrained Kerberos delegation or DES encryption, not only for signed-in credentials, but also prompted or saved credentials.

    Credential Guard is active by default on Windows 11 22H2 (or later) Enterprise and Education editions.