Windows Registry Delete of Credential Guard EnableVirtualizationBasedSecurity or LsaCfgFlags

Flags deletion of Credential Guard/LSA-related registry values that may weaken virtualization-based secret protection.

FreeUnreviewedSigmahighv1

windows-registry-delete-of-credential-guard-enablevirtualizationbasedsecurity-or-d645ef86

title: Windows Registry Delete of Credential Guard EnableVirtualizationBasedSecurity or LsaCfgFlags
id: ce46f106-cedf-4757-8611-e34341c80bdc
related:
  - id: c17d47b7-dcd6-4109-87eb-d1817bd4cbc9
    type: similar
  - id: d645ef86-2396-48a1-a2b6-b629ca3f57ff
    type: derived
status: experimental
description: This rule identifies registry value deletions associated with Windows Credential Guard and LSA configuration, including Device Guard and LsaCfgFlags keys. Removing these values can be used to undermine virtualization-based security protections that help keep secrets isolated. It relies on Windows registry delete telemetry that reports the TargetObject path ending in specific Credential Guard-related registry value names.
references:
  - https://github.com/DambergC/SaveFolder/blob/90e945eba80fae85f2d54b4616e05a44ec90c500/Cygate%20Installation%20tool%206.22/Script/OSD/OSDeployment-CredentialGuardDisable.ps1#L50
  - https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/configure
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_delete/registry_delete_disable_credential_guard.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-12-26
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  category: registry_delete
  product: windows
detection:
  selection:
    TargetObject|endswith:
      - \DeviceGuard\EnableVirtualizationBasedSecurity
      - \DeviceGuard\LsaCfgFlags
      - \DeviceGuard\RequirePlatformSecurityFeatures
      - \Lsa\LsaCfgFlags
  condition: selection
falsepositives:
  - Unlikely
level: high
regression_tests_path: regression_data/rules/windows/registry/registry_delete/registry_delete_disable_credential_guard/info.yml
license: DRL-1.1

What it detects

This rule identifies registry value deletions associated with Windows Credential Guard and LSA configuration, including Device Guard and LsaCfgFlags keys. Removing these values can be used to undermine virtualization-based security protections that help keep secrets isolated. It relies on Windows registry delete telemetry that reports the TargetObject path ending in specific Credential Guard-related registry value names.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.