{"id":3158,"date":"2025-08-25T10:12:10","date_gmt":"2025-08-25T10:12:10","guid":{"rendered":"https:\/\/cert-mu.govmu.org\/cert-mu\/?page_id=3158"},"modified":"2025-08-25T10:12:50","modified_gmt":"2025-08-25T10:12:50","slug":"hackers-steal-windows-secrets-and-credentials-undetected-by-edr-detection","status":"publish","type":"page","link":"https:\/\/cert-mu.govmu.org\/cert-mu\/?page_id=3158","title":{"rendered":"Hackers Steal Windows Secrets and Credentials Undetected by EDR Detection"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-page\" data-elementor-id=\"3158\" class=\"elementor elementor-3158\" data-elementor-post-type=\"page\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-a82847b elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"a82847b\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-b80d8dd\" data-id=\"b80d8dd\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-f21d1a0 elementor-widget elementor-widget-text-editor\" data-id=\"f21d1a0\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>A cybersecurity researcher has unveiled a sophisticated new method for extracting Windows credentials and secrets that successfully evades detection by most Endpoint Detection and Response (EDR) solutions currently deployed in enterprise environments. The technique, dubbed \u201cSilent Harvest,\u201d leverages obscure Windows APIs to access sensitive registry data without triggering common security alerts.<\/p><p>The breakthrough represents a significant advancement in red team operations and highlights critical gaps in how security solutions monitor system activities.<\/p><p>Unlike traditional credential harvesting methods that are increasingly detected and blocked by modern defenses, this approach operates entirely in memory without creating telltale artifacts that EDR products typically monitor.<\/p><p><strong>Read More: <\/strong><\/p><p><a href=\"https:\/\/gbhackers.com\/windows-secrets-and-credentials-exposed\/\">https:\/\/gbhackers.com\/windows-secrets-and-credentials-exposed\/<\/a><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>A cybersecurity researcher has unveiled a sophisticated new method for extracting Windows credentials and secrets that successfully evades detection by most Endpoint Detection and Response (EDR) solutions currently deployed in enterprise environments. The technique, dubbed \u201cSilent Harvest,\u201d leverages obscure Windows APIs to access sensitive registry data without triggering common security alerts. The breakthrough represents a significant advancement in red team operations and highlights critical gaps in how security solutions monitor system activities. Unlike traditional credential harvesting methods that are increasingly detected and blocked by modern defenses, this approach operates entirely in memory without creating telltale artifacts that EDR products typically\u2026<\/p>\n","protected":false},"author":7,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-3158","page","type-page","status-publish","hentry"],"blocksy_meta":"","_links":{"self":[{"href":"https:\/\/cert-mu.govmu.org\/cert-mu\/index.php?rest_route=\/wp\/v2\/pages\/3158","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert-mu.govmu.org\/cert-mu\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/cert-mu.govmu.org\/cert-mu\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/cert-mu.govmu.org\/cert-mu\/index.php?rest_route=\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/cert-mu.govmu.org\/cert-mu\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3158"}],"version-history":[{"count":4,"href":"https:\/\/cert-mu.govmu.org\/cert-mu\/index.php?rest_route=\/wp\/v2\/pages\/3158\/revisions"}],"predecessor-version":[{"id":3162,"href":"https:\/\/cert-mu.govmu.org\/cert-mu\/index.php?rest_route=\/wp\/v2\/pages\/3158\/revisions\/3162"}],"wp:attachment":[{"href":"https:\/\/cert-mu.govmu.org\/cert-mu\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3158"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}