,
4 tweets,
1 min read
Read on Twitter
Popular attacker trick in corporate networks: change the WDigest UseLogonCredential registry key to 1.
Helpful if you want to transmute RDP brute forced local admin credential into domain credentials without risking a Mimikatz detection.
Why?
WDigest=plaintext creds in memory.
Helpful if you want to transmute RDP brute forced local admin credential into domain credentials without risking a Mimikatz detection.
Why?
WDigest=plaintext creds in memory.
WDigest credentials being available in memory means attackers can use alternate sophisticated tools like taskmanager to get credentials versus bringing cred theft tools that AV might detect. WDigest is disables by default but can be enabled as admin without reboot (just lock.)
Monitoring changes to the WDigest registry key can give you a hint that someone might be interested in weakening your security posture or an attack might be starting.
And before @gentilkiwi points out AV doesn’t detect Mimikatz well, don’t worry - even when it is detected some attackers will hit AV detections several times with different techniques before hitting something that succeeds. Triaging even boring commodity alerts is important. :)
