WDigest UseLogonCredential Enabled for Clear-Text Credentials

Google SecOps@GoogleSecOps

•updated Jun 25, 2025•0•40

Detects potential malicious modification of the 'UseLogonCredential' property value within the WDigest registry key to enable clear-text credential storage. This modification can allow attackers to dump credentials from LSASS memory.