STAC3725 WDigest Credential Capture, FTK Imager Defender Abuse, K7RKScan Driver Load

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects multiple methods commonly used for defense evasion and credential theft on Windows systems, including: enabling WDigest credential caching via Registry modification, execution of forensic tools (FTK Imager) sometimes repurposed for security tool tampering, disabling Microsoft Defender real-time monitoring or removing exclusions via PowerShell/CMD, and loading known vulnerable kernel drivers associated with BYOVD (Bring Your Own Vulnerable Driver) attacks.