WDigest Credential Caching followed by LSASS Memory Dumping - Storm-1175 - Medusa
This query detects the specific credential access pattern used by Storm-1175 (Medusa ransomware operators). The threat actor first modifies the registry to re-enable WDigest plaintext credential caching, then performs LSASS memory dumping (via Task Manager, Procdump, Mimikatz, NanoDump, or rundll32 comsvcs.dll techniques). By correlating the registry change with subsequent suspicious LSASS access activity within an 8-hour window, the hunt maintains high fidelity even if the actor switches between different dumping tools.
Microsoft Sentinel (KQL)
