Windows Cached Domain Credentials Registry Query

The analytic identifies a process command line querying the CachedLogonsCount registry value in the Winlogon registry. This activity can indicate the use of post-exploitation tools like Winpeas, which gather information about login caching settings. If confirmed malicious, this activity could help attackers understand login caching configurations, potentially aiding in credential theft or lateral movement within the network.