WDigest UseLogonCredential Downgrade with LSASS Credential Access Chain

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•1

Detects the modification of the WDigest 'UseLogonCredential' registry value to 1 (enabling plaintext credential storage in memory) followed by subsequent access to the LSASS process, a common sequence in credential dumping attacks.