Modification of WDigest UseLogonCredential Registry Key

The WDigest authentication protocol is a legacy Windows mechanism that historically stored credentials in clear-text within memory. To mitigate the risk of credential theft, Microsoft released updates to disable this behavior by default. Adversaries exploit the HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest registry key to re-enable the 'UseLogonCredential' setting. By setting this DWORD value to 1, attackers force the system to store user credentials in clear-text, which can subsequently be dumped from the Local Security Authority Subsystem Service (LSASS) process. This technique is frequently observed in post-exploitation scenarios where actors seek to escalate privileges or move laterally within a domain environment. Defenders should monitor registry modifications targeting this specific path as a high-fidelity signal of credential harvesting preparations.

Attack Chain

1. Attacker gains administrative access to the target endpoint.
2. Attacker identifies the target registry path HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest.
3. Attacker uses reg.exe or PowerShell Set-ItemProperty to create or modify the 'UseLogonCredential' DWORD value to 1.
4. The operating system configuration is updated to allow clear-text credential storage.
5. The attacker waits for a legitimate user or administrative account to perform a new logon session.
6. The attacker uses credential dumping tools like Mimikatz or procdump to extract clear-text credentials from the lsass.exe process memory.
7. The attacker uses the recovered clear-text credentials to authenticate to other services or systems within the network.

Impact

Successful exploitation results in the exposure of clear-text user credentials, significantly increasing the risk of lateral movement and privilege escalation. This technique facilitates the compromise of domain-wide administrative accounts, potentially leading to total directory service takeover if the credentials belong to highly privileged users.

Recommendation

Prioritize the deployment of the provided Sigma rule to detect unauthorized modifications to the WDigest registry key. Investigate all alerts originating from administrative accounts or processes not associated with known system configuration management tools. Ensure that LSASS memory dumping is simultaneously restricted via EDR policies to prevent the final extraction of the credentials enabled by this registry change.