WDigest UseLogonCredential Registry Key Set to Enable Plaintext Caching

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects the modification of the 'UseLogonCredential' registry value within the WDigest configuration key to 1. Enabling this value forces Windows to cache user credentials in plaintext in the memory of the Local Security Authority Subsystem Service (LSASS), which is a common post-exploitation step to facilitate credential harvesting using tools like Mimikatz.