WDigest UseLogonCredential Registry Set for Plaintext Credential Caching

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects modifications to the Windows Registry designed to enable the WDigest authentication provider, which forces the storage of credentials in plaintext in memory. This is a common technique used by attackers to simplify credential harvesting using tools like Mimikatz.