WDigest UseLogonCredential Registry Modification to Enable Plaintext Credentials

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

Detects the modification of the WDigest 'UseLogonCredential' registry key. Enabling this key forces the WDigest security provider to store plaintext credentials in memory, which is a common technique used by attackers to dump credentials via tools like Mimikatz.