All Detections

Wdigest Enable UseLogonCredential

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 20251018

Detects potential malicious modification of the property value of UseLogonCredential from HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to enable clear-text credentials

Sigma