S12cybersecurity / CredGuardRuntimeShutdown
git clone https://github.com/S12cybersecurity/CredGuardRuntimeShutdown.git
Proof-of-concept Windows tool that attempts to disable Credential Guard at runtime and read NT hashes from LSASS memory on Windows 11 24H2.
Why you might care
Aimed at security researchers and defenders studying Credential Guard bypass techniques and their detection. The README includes a table of telemetry indicators (audit events, Sysmon, WMI, EDR correlation) that can help build detections. It is tied to one specific Windows build and requires an admin context, and it is not a general-purpose credential tool.
+1
stars, 24h · #24,617
+81
stars, 7 days · #3,796
+81
stars, 30 days · #11,045
81
★ total · +81% this week
14
forks · 0 open issues
Star history (as recorded here)
LanguageC
License—
Created2026-10-27 (6d ago)
Last push6d ago
Watchers0
OwnerUser
Links
- GitHub: github.com/S12cybersecurity/CredGuardRuntimeShutdown
- Releases · Issues · Hacker News mentions
README
Loading README…
Blurb generated by claude-haiku-5-5 5d ago. Star deltas marked ~ are extrapolated from partial history.