Wdigest Enable UseLogonCredential

Title: Wdigest Enable UseLogonCredential
Status: test
Description:Detects potential malicious modification of the property value of UseLogonCredential from HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to enable clear-text credentials
References:
  -https://threathunterplaybook.com/hunts/windows/190510-RegModWDigestDowngrade/notebook.html
  -https://support.microsoft.com/en-us/topic/microsoft-security-advisory-update-to-improve-credentials-protection-and-management-may-13-2014-93434251-04ac-b7f3-52aa-9f951c14b649
  -https://github.com/redcanaryco/atomic-red-team/blob/73fcfa1d4863f6a4e17f90e54401de6e30a312bb/atomics/T1112/T1112.md#atomic-test-3---modify-registry-to-store-logon-credentials
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2019-09-12
modified:2023-08-17
Tags:

• -'attack.persistence'
• -'attack.defense-impairment'
• -'attack.t1112'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|endswith: 'WDigest\UseLogonCredential'
    Details: 'DWORD (0x00000001)'
  condition:selection
Falsepositives:
  -Unknown
Level: high