WDigest UseLogonCredential Registry Downgrade for Plaintext Credential Caching

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects attempts to modify the WDigest UseLogonCredential registry value, which can be used to force Windows to store plaintext credentials in LSASS memory. Adversaries use this technique to facilitate credential dumping.