To potentially enable a pass-the-hash attack on a Windows target, which action could be necessary within the engagement scope?

• A. Disable the local firewall on the target
• B. Patch the vulnerability used in the attack
• C. Enumerate credentials from memory
• D. Disable Windows Defender Credential Guard on the target machine

Answer: (D)

Pass-the-hash uses stolen NTLM credentials to authenticate to other services without the actual password. Windows Defender Credential Guard keeps those secrets isolated in a secure container, so typical credential dumping and reuse tools can’t access or extract them. In an engagement, disabling Credential Guard on the target is often necessary to allow access to credentials in memory and to reuse them for lateral movement. The other options don’t enable this technique: removing the firewall addresses network visibility but not credential access, patching the vulnerability would prevent the attack, and while enumerating credentials from memory is part of the attack, it requires that credentials be accessible in the first place, which Credential Guard blocks.