S12cybersecurity/CredGuardRuntimeShutdown
Can I trust it?
Be careful with this one.
Warnings Check
Very new: it was created 2 days ago. Wait a little before installing it.
Stars from real accounts No data
We haven't checked its stars for fakes yet.
Active OK
Last change 2 days ago.
Licence Careful
No licence: legally you can't reuse the code, unless the README says otherwise.
Quick checks from public data. They help, but they are no guarantee.
What it is
Proof-of-concept C code that claims to disable Windows Credential Guard at runtime and read NT password hashes from LSASS memory after a test logon. It requires an elevated admin process and includes a list of detection indicators.
Who it's for
Security researchers and defenders evaluating Credential Guard and LSASS protections on Windows 11 24H2
How to use it
Ask your AI to set it up
Paste this into Claude, ChatGPT or your coding assistant.
Help me install and set up S12cybersecurity/CredGuardRuntimeShutdown in my project. Follow its README: https://github.com/S12cybersecurity/CredGuardRuntimeShutdown. Explain each step and check it is safe before running anything.
Star curve
Get alerts for repos like this
We'll email you when repos like this start rising. Free, once a week, only what matches.
22,155 GitHub repos watched and ranked every hour. Figures as of 29 October 2026.
What arrives: one email on Mondays with the repos that match, never more. See last week's. Privacy
For maintainers
Add this badge to your README. It shows the repo's place on the radar, updates every hour and links back to this page.
[](https://repoalerts.com/repo/S12cybersecurity/CredGuardRuntimeShutdown?ref=badge)Similar repos
- HydraSecurityTools/exploit-signed-exe
A Windows project that builds a DLL intended to be loaded by a signed executable, exposing exported functions for testing. Its description states the aim is to reduce Microsoft Defender SmartScreen wa
- sakidekin/CVE-2026-41940-PoC
Python command-line tool that exploits CVE-2026-41940, an authentication bypass in cPanel and WHM, to gain unauthenticated root-level WHM access. Supports single-target and list scans, plus post-explo
- notinferred/keypaste
A KeePass-compatible password and secrets manager that stores logins and project environment variables in a local KDBX vault with no account or network. It injects secrets into commands and asks the u
- ZeroDayEvil/CVE-2026-75604-PoC
A security audit module for the AI Security Tool that detects and validates CVE-2026-75604, an unauthenticated remote code execution flaw in Next.js applications on Windows. It is run from the AI Secu
- NobleLarvaCharge/SystemCare-Pro
Presents itself as an installer for a Windows system optimization utility, distributed as a pre-activated build. The README instructs users to run a remote PowerShell script from an unrelated domain a
- SplendorCooper/ExitLag
Distributes a pre-activated Windows installer for a program called Exitlag, described as an optimized desktop utility. The README gives a PowerShell command that downloads and runs a remote script and