Windows Wdigest Enabled Via Registry
Detects attempts to enable WDigest credential caching by modifying the 'UseLogonCredential' registry value. This allows plaintext credentials to be stored in memory, which can then be harvested by attackers. The threat group ShadowSilk has been observed using this technique.
YARA-L
