BEGIN:VCALENDAR
VERSION:2.0
PRODID:Data::ICal 0.24
BEGIN:VEVENT
DESCRIPTION:   'Title: Beyond NPPSPY: Harvesting Credentials via Windows Cr
 edential\n   Provider Framework\n   Tags: Red Team Village | Misc\n   When
 : Sunday\, Aug 9\, 10:00 - 10:59 PDT\n   Where: LVCCW Level 1 Hall 1 309 (
 Red Team Village) Workshop Stage 1 -\n   [1]Map\n\n   Description:\n\n   F
 or years\, Red Teams have relied on techniques like NPPSpy and LSASS\n   d
 umping for credential harvesting. But as EDRs and defenders get\n   smarte
 r\, these traditional paths are heavily monitored and immediately\n   flag
 ged. What if we could intercept credentials right at the\n   source—the 
 Windows Logon UI—while seamlessly bypassing Application\n   Control solu
 tions?\n\n   In this talk\, we will journey deep into the arcane world of 
 the\n   Windows Credential Provider Framework and COM (Component Object Mo
 del)\n   architecture. I will demonstrate how to build a stealthy "Middle-
 Man"\n   Credential Provider that wraps around the default Windows Passwor
 d\n   Provider. By abusing interfaces like ICredentialProviderFilter and\n
    intercepting methods like GetSerialization\, we can silently harvest\n 
   both cleartext passwords and serialized authentication payloads.\n\n   W
 e'll explore the COM "chicken-and-egg" instantiation process\, the\n   ope
 rational security considerations of operating inside logonui.exe\,\n   and
  most importantly\, how this technique achieves a complete bypass of\n   A
 ppLocker by proxying execution through a trusted system process.\n   Final
 ly\, we'll discuss its limitations against strict WDAC policies\n   and ho
 w defenders can hunt for this elusive persistence mechanism.\n\n   Researc
 h Motivation & Core Concept\n\n   The core insight of this research is mov
 ing away from the highly\n   monitored Network Provider registry keys (HKL
 M\\SYSTEM\\CurrentControlSet\\Services\\LanmanWorkstation\\NetworkProvider
 )\n   and LSASS memory space. Instead\, this research leverages the Window
 s\n   Credential Provider Framework. By writing a custom COM DLL\, we can\
 n   create a "wrapper" around the native Windows Password Credential\n   P
 rovider ({60b78e88-ead8-445c-9cfd-0b87f74ea6cd}).\n\n   To avoid drawing s
 uspicion\, the user must not see two password fields.\n   This research ut
 ilizes the ICredentialProviderFilter interface to\n   explicitly filter ou
 t (hide) the default Windows provider\, leaving\n   only our malicious wra
 pper.\n\n   Technical Insights & Evasion Mechanics\n\n     1. COM Interfac
 e Abuse: The talk details the exact implementation of\n       IUnknown\, I
 ClassFactory\, ICredentialProvider\, and\n       ICredentialProviderCreden
 tial required to successfully trick\n       logonui.exe into loading the m
 alicious provider.\n\n     2. Data Harvesting: I will break down how to ex
 tract cleartext\n       passwords by intercepting the SetStringValue metho
 d\, and how to\n       capture serialized payloads (like NTLM hashes/Kerbe
 ros material)\n       by intercepting GetSerialization before passing exec
 ution back to\n       the native provider.\n\n     3. AppLocker vs. WDAC: 
 A major finding of this research is\n       Application Control bypass. Be
 cause the custom DLL is loaded by\n       logonui.exe (a highly trusted\, 
 system-level process)\, AppLocker is\n       completely bypassed. However\
 , I will also transparently discuss\n       WDAC: under strict Enforce Mod
 e\, WDAC's CodeIntegrity checks will\n       successfully block the unsign
 ed DLL (Event 3033)\, making this a\n       great comparative study of App
 Locker vs. WDAC for defenders.\n\n     4. OpSec Constraints: I will cover 
 the developer-side OpSec\n       required\, such as compiling with /MT (st
 atically linking the CRT)\n       to avoid MSVCP140.dll dependency crashes
  in the logon screen\, and\n       securely saving harvested credentials v
 ia XOR encryption to\n       C:\\Windows\\Temp.\n\n   Target Audience\n\n 
     * Red Teamers looking for stealthy persistence and credential\n       
 harvesting techniques\;\n\n     * Blue Teamers and Security Engineers task
 ed with tuning EDRs and\n       writing Application Control (AppLocker/WDA
 C) policies.\n\n   SpeakerBio:  Sohail Saha\n\n   Sohail is a Penetration 
 Tester at Optiv specializing in Windows\n   internals and offsec tool deve
 lopment. Previously a developer at\n   Polygon\, they now leverage their s
 oftware engineering background to\n   build offensive tooling and research
  OS architecture. When not\n   bypassing security controls or writing C++\
 , he can be found playing\n   guitar\, reading\, or working on their debut
  sci-fi novel.\n\n   '\n\n   1. #LVCCW_Level1_Hall1\n\n\n
DTEND:20260809T175900Z
DTSTART:20260809T170000Z
LOCATION:Red Team Village - LVCCW Level 1 Hall 1 309 (Red Team Village) Wor
 kshop Stage 1
SUMMARY:Beyond NPPSPY: Harvesting Credentials via Windows Credential Provid
 er Framework
END:VEVENT
END:VCALENDAR