How does this setting mitigate a "privilege escalation from credential theft" attack?
The answer to the question depends upon the precise details of how the
Deny access to this computer from the network setting works. We have to understand exactly what this setting does before we can say it is useful in mitigating a potential vulnerability.
What does this setting do?
This setting is a forced "access denied" for remote SMB network connections, even if connections are allowed via other means. It is similar to a "Deny" entry in an Access Control List and is evaluated before
Allow access to this computer from the network (just like with access control lists in Windows). Also, it is important to understand that this setting does not apply to RDP connections. Two common examples of SMB connections are the "Net use" command and MMC snap-ins such as the Event Viewer tool.
What is the risk of remote SMB connections?
Remote SMB connections do not expose credentials on a remote host. So this means if I connect to a compromised system with a privileged account using only a remote SMB connection (e.g., an MMC snap-in), my privileged account credentials are not exposed on the compromised system.
How does this setting mitigate the threat of credential theft?
Remote SMB connections do not expose credentials, so there's no threat of credential theft. Therefore the
Deny access to this computer from the network setting is unnecessary to mitigate this threat.
Why is this setting suggested as a remediation to prevent potential credential theft?
There appears to be a fair amount of misunderstanding regarding what
Deny access to this computer from the network does. Properly understood, this setting is unnecessary for mitigating credential theft because credentials are not exposed from remote SMB connections.
Explanation by way of analogy
Suppose there is a young woman named Emilia who has heard that there is a handbag shop that carries a particular handbag that she wants to buy. The shop is in a part of town known for a group of thieves stealthily stealing peoples' credit cards without their knowledge, so the shop has tried reducing some prices to increase business. This was in the days before the Internet and web sites, and she hears a commercial on the radio that they have a particular bag she wants to buy.
She wants to verify the price for herself, so she has two options: 1) Drive down to the shop and risk getting her credit card stolen, or 2) call the shop on the phone and verify the price. (She is careful and refuses to give her credit card number over the phone.)
What is the risk of her credit card number being stolen from her if she does not physically drive down to the handbag shop? Of course, there is no risk, since her credit card is never physically there to be stolen. [Remote SMB connection: Credentials are not exposed] If she drives down to the store, then there is a risk of the clever thieves stealing her credit card. [Interactive logon = potential credential theft]
So in other words, this question is asking: If Emilia only calls the shop on the phone, and does not give out her credit card number over the phone, what is the risk of her credit card number being stolen from her? The answer of course is that there is no risk in that case.
Process policy vs. technical policy
It seems that DISA recommends this setting to help organizations enforce a good process policy. This setting can be useful in that context to prevent members of
Domain Admins from connecting to remote computers using SMB connections and pursue other administrative means. However, the question is asking about the technical details of this setting, not its process implications. At this time it appears that the DISA recommendation is giving an incorrect technical description of this recommendation, when in fact they should be providing a valid process recommendation.