Wdigest CredGuard Registry Modification (1a2d6c47-75b0-45bd-b133-2c0be75349fd)
Detects potential malicious modification of the property value of IsCredGuardEnabled from HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to disable Cred Guard on a system. This is usually used with UseLogonCredential to manipulate the caching credentials.
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Modify Registry - T1112 (57340c81-c025-4189-8fa0-fc7ede51bae4) | Attack Pattern | Wdigest CredGuard Registry Modification (1a2d6c47-75b0-45bd-b133-2c0be75349fd) | Sigma-Rules | 1 |