Qilin Enable Wdigest Credential Caching

Tim Peck@timpeck

•updated Oct 28, 2025•1•0•110

Detects the modification of the WDigest registry key to enable plaintext credential caching. This technique is used by threat actors like the Qilin ransomware group to harvest credentials from memory using tools like Mimikatz.