Credential Guard and VBS disable artifact detector — free browser tool | fatcousin

drop system evtx csv and registry export · detect virtualization based security disabled · identify credential guard removal enabling credential theft · surface vbs configuration changes · runs locally

artifacts

drop system / security evtx csv · registry (multi-file)

or click

Select file

VBS · LsaCfgFlags · HVCI · Event 4657 · 1074/6005/6006 · bcdedit hypervisorlaunchtype · lsass access

drop system evtx csv · security evtx csv · registry export

ready