WDigest UseLogonCredential Enabled by Non-System Process

Ankit Mehta@Secvyn

•updated Jun 26, 2026•0•0•1

Detects the modification of the 'UseLogonCredential' registry value to '1' within the WDigest security package settings. Enabling this setting allows the WDigest authentication protocol to cache cleartext credentials in the LSASS process memory, which is a common technique used by attackers to facilitate credential dumping and facilitate lateral movement.