Hide Your Valuables: Mitigating Physical Credential

The talk starts with the basics of virtual and physical memory on Windows, then explains why attackers target LSASS for Kerberos tickets, NTLM hashes and cleartext passwords. It walks through common dumping routes: reading process memory directly, using bring-your-own-vulnerable-driver attacks to get past Protected Process Light, and pulling physical memory through forensic drivers, crash dump settings, or virtual machine snapshot files.

The core idea is to shorten how long sensitive pages stay resident in RAM. The presenters built Silhouette, a kernel driver that watches LSASS's working set and flushes standby and modified pages so they are not resident for long. They also cover blocking raw disk reads and volume shadow copy access to the page file. Live demos show the dumping tools failing against the protected setup, and the speakers are candid about limits, such as flushing that applies systemwide and attackers who might repeatedly race short-lived pages.

For defenders, the takeaways are to run LSASS as a protected process with its UEFI lock, enable Credential Guard where hardware allows, block vulnerable and forensic memory drivers, and watch for changes to page file configuration. Their basic benchmarks showed no noticeable performance hit, though results will depend on workload and hardware.