# Elastic Defend - Credential Harderning
**URL:** https://discuss.elastic.co/t/elastic-defend-credential-harderning/342858
**Category:** Elastic Security
**Created:** [September 12, 2023, 2:51pm UTC](https://discuss.elastic.co/t/elastic-defend-credential-harderning/342858 "2023-09-12T14:51:54Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@slash24](https://discuss.elastic.co/u/slash24)
#### Post date: [September 12, 2023, 2:51pm UTC](https://discuss.elastic.co/t/elastic-defend-credential-harderning/342858/1 "2023-09-12T14:51:54Z")
What does the ["Credential hardening"](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html#attack-surface-reduction)-setting in Elastic Defend-integration do for Windows-endpoints when active?
Does it simply set the [RunasPPL](https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection#how-to-enable-lsa-protection-on-a-single-computer) registry key?
We have thirdparty components involved in authentication and there is no Detect/Prevent-toggle for this one like on Ransomware/Malware etc.
---
### Author:  [@gabriel.landau](https://discuss.elastic.co/u/gabriel.landau)
#### Post date: [September 12, 2023, 6:29pm UTC](https://discuss.elastic.co/t/elastic-defend-credential-harderning/342858/2 "2023-09-12T18:29:07Z")
Hi @slash24 - great question.
Credential Hardening filters handles granted to LSASS, stripping out abusable rights such as `PROCESS_VM_READ`. It provides protection that partially overlaps with RunAsPPL, with some key differences.
Unlike RunAsPPL, Credential Hardening protects LSASS against handle abuse even by higher-privileged processes. This stops attacks that bypass RunAsPPL by injecting code into higher-privileged PPL, such as [PPLFault](https://github.com/gabriellandau/PPLFault).
Unlike Credential Hardening, RunAsPPL ensures LSASS can only load DLLs signed by Microsoft, blocking [SSP and Authentication Package DLL injection](https://www.ired.team/offensive-security/credential-access-and-credential-dumping/intercepting-logon-credentials-via-custom-security-support-provider-and-authentication-package). Defend has [behavioral rules](https://github.com/elastic/protections-artifacts/blob/7246530c2f89238a9c14fd33f96e86f96db01906/behavior/rules/persistence_suspicious_windows_authentication_registry_modification.toml) to detect and stop these types of attacks, but the approach is different than RunAsPPL. Some environments require custom authentication package DLLs and are thus incompatible with RunAsPPL.
We recommend enabling both Credential Hardening and RunAsPPL together wherever possible. For RunAsPPL, enable the UEFI lock if your environment supports it.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 10, 2023, 6:29pm UTC](https://discuss.elastic.co/t/elastic-defend-credential-harderning/342858/3 "2023-10-10T18:29:38Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.