Privileged logon within 72h after WDigest UseLogonCredential enabled
Detects the enabling of the WDigest UseLogonCredential registry value, which forces the storage of plaintext credentials in memory by the LSASS process, followed by a privileged interactive or remote interactive logon on the same host within 72 hours. This sequence suggests an attacker is positioning the system to harvest credentials.
YARA-L
