Storm-1175 - Medusa - WDigest Enablement Followed by LSASS Credential Dumping

Awais Munir@iawais

•updated Jul 15, 2026•3•1•13

Detects enabling of WDigest credential caching (UseLogonCredential=1) in the registry, followed within 6 hours by execution of common credential dumping tools (procdump, Mimikatz, NanoDump, taskmgr + LSASS/MiniDump/comsvcs) on the same host. This pattern is a strong indicator of post-exploitation credential access in high-tempo ransomware operations like Medusa (Storm-1175).