WDigest UseLogonCredential Registry Enabled for Plaintext Creds

Ibrahim Saud@tektrix

•updated 13 days ago•0•0•2

Detects modifications to the WDigest 'UseLogonCredential' registry key. Enabling this setting (setting it to 1) forces the WDigest SSP to store plaintext credentials in memory, which facilitates easier credential harvesting by attackers using memory dumping techniques.