15How do attackers steal and reuse credentials in a Windows enterprise, and how do you reduce the damage when an endpoint is compromised?▼hardNewMicrosoftCrowdStrikePalo Alto Networks◆ premiumYou cannot stop every laptop being compromised. You can decide what that laptop holds. The strong answer is about which credentials live where, and making stolen ones useless elsewhere.Open full answer →
39Where do Windows credentials live (LSASS, SAM, DPAPI), how are they stolen, and what do LSA protection, Credential Guard and LAPS change?▼hardNewMicrosoftCrowdStrikePalo Alto Networks◆ premiumOnce an attacker is admin on one machine, the credentials cached there decide whether they stop at one machine or reach the domain. Every control in this answer is about that step.Open full answer →
47How does Windows run services and hold credentials in LSASS, and why are services and LSASS central to both attack and defence?▼mediumNewMicrosoftCrowdStrikePalo Alto Networks◆ premiumTwo things make Windows compromise spread: services that run with powerful identities, and a process that holds the credentials of everyone logged on.Open full answer →