Detection of WDigest Credential Dumping Configuration

This brief addresses the abuse of the Windows WDigest authentication protocol configuration. By setting the 'UseLogonCredential' registry value to 1, attackers force the Local Security Authority Subsystem Service (LSASS) to cache plaintext credentials in memory. This configuration change is a classic post-exploitation technique used by frameworks like Mimikatz to facilitate credential dumping. Once plaintext credentials are extracted from LSASS memory, actors can conduct lateral movement, privilege escalation, and persistence across a Windows environment. This activity is typically performed after initial access has been established, requiring administrative privileges on the target host.

Attack Chain

1. Attacker gains administrative access to the target host.
2. Attacker interacts with the Windows Registry via reg.exe, PowerShell, or malicious scripts.
3. Attacker modifies the HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest\ registry key.
4. Attacker sets the 'UseLogonCredential' value to 1.
5. Attacker forces a user re-authentication or waits for a new logon event to trigger credential caching.
6. Attacker executes a credential dumping tool (e.g., Mimikatz) to read the LSASS process memory.
7. Attacker extracts plaintext credentials from the dumped memory.
8. Attacker uses extracted credentials to move laterally or elevate privileges within the network.

Impact

Successful exploitation leads to the compromise of user and service account credentials. This provides attackers with the ability to move laterally across the domain, escalate privileges, and maintain long-term access, potentially impacting the confidentiality and integrity of all systems accessible by the compromised credentials.

Recommendation

• Deploy the provided Sigma rule to monitor for registry modifications within the WDigest configuration path.
• Audit administrative access to registry keys governing security providers.
• Enforce LSASS protection (e.g., LSA Protection/RunAsPPL) to hinder unauthorized memory dumping tools.
• Monitor for the execution of credential dumping utilities in environments where the WDigest configuration change is observed.