WDigest Enablement (OS Credential Dumping: LSASS)
Details: Detection to identify registry modifications to enable WDigest. Enabling WDigest forces LSASS to store cached credentials in plain text which can be dumped and used immediately for lateral movement/privilege escalation without the need for offline brute-forcing of hashes. Hypothesis: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory. These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement using Use Alternate Authentication Material. Recommended actions: Review process tree and conduct device timeline analysis to determine root cause - it may be necessary to confirm activity with the end user. References: https://jumpcloud.com/it-index/what-is-wdigest, https://cybersecuritynews.com/exposed-server-reveals-thegentlemen-ransomware-toolkit/
Microsoft Sentinel (KQL)
