WDigest UseLogonCredential Registry Set to Enable Plaintext Caching
Detects modifications to the 'UseLogonCredential' registry value under the WDigest security provider. Enabling this setting allows Windows to store plaintext credentials in memory (LSASS), which facilitates credential theft and credential dumping attacks.
Splunk (SPL)
