WDigest UseLogonCredential Enabled to Force Plaintext Credential Caching

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•1

Detects modifications to the WDigest UseLogonCredential registry key, which enables the caching of plaintext credentials in LSASS memory. This is a common post-exploitation technique used to facilitate credential theft.