Credential Theft Protection (CTP) is designed to cease attacks that specifically targets Local Security Authority Subsystem Service (LSASS) or the lsass.exe process on Windows systems.
Note
Credential Theft Protection (CTP) is not supported in the ARM architecture.
LSASS is responsible for enforcing security policy on Windows systems. It also stores credentials to:
Verify users logging on to a Windows computer or server.
Handles password changes.
Creates access tokens.
The caching of credentials makes LSASS a potential target for credential theft; especially in the Windows 7 operating system, where credentials are stored in clear text format. Certain hacker tools explicitly target LSASS memory. CTP helps to curb the exposure of LSASS memory by blocking or redirecting attempts to open the lsass.exe process for reading.