Wdigest Credential Guard Registry Modification

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•49

Detects potential malicious modification of the 'IsCredGuardEnabled' property value within the WDigest registry key to disable Credential Guard on a system. This action is often performed in conjunction with 'UseLogonCredential' to manipulate credential caching, potentially leading to credential dumping.