Skip to content

Commit e862612

Browse files
committed
Learn Editor: Update attack-surface-reduction-rules-reference.md
1 parent 9d0e38f commit e862612

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

defender-endpoint/attack-surface-reduction-rules-reference.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -322,6 +322,8 @@ Dependencies: Microsoft Defender Antivirus
322322

323323
### Block credential stealing from the Windows local security authority subsystem
324324

325+
> [!NOTE]
326+
> If you have [LSA protection](/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection) enabled and [Credential Guard](/windows/security/identity-protection/credential-guard) enabled this ASR rule is not required.
325327
This rule helps prevent credential stealing by locking down Local Security Authority Subsystem Service (LSASS).
326328

327329
LSASS authenticates users who sign in on a Windows computer. Microsoft Defender Credential Guard in Windows normally prevents attempts to extract credentials from LSASS. Some organizations can't enable Credential Guard on all of their computers because of compatibility issues with custom smartcard drivers or other programs that load into the Local Security Authority (LSA). In these cases, attackers can use tools like Mimikatz to scrape cleartext passwords and NTLM hashes from LSASS.

0 commit comments

Comments
 (0)