Qilin: Enabling WDIGEST from custom .bat file
This rule detects attempts to enable WDigest credential caching by modifying the 'UseLogonCredential' registry value to '1' under a key containing 'WDigest'. The detection specifically looks for this modification being performed by a process whose image name matches a custom batch file pattern (e.g., ending with '!light*.bat'). This activity is associated with Qilin ransomware, which has been observed using this technique for credential access.
Cortex XDR
