WDigest UseLogonCredential Registry Set to Enable Plaintext Credential Caching

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the modification of the WDigest registry key 'UseLogonCredential' to 1. This configuration forces the Windows LSA process to store plaintext credentials in memory, significantly facilitating credential harvesting techniques such as those employed by Mimikatz.