WDigest Forced Credential Caching (PowerShell)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

WDigest is a legacy authentication protocol used by Windows, primarily for backward compatibility, that stores credentials in memory, potentially allowing plaintext password access if enabled. Threat actors may adjust wdigest registry values to facilitate credential harvesting. This use case detects commands to modify the WDigest registry value.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1112` Modify Registry
Defense Impairment	`T1112` Modify Registry
Credential Access	`T1003.005` OS Credential Dumping: Cached Domain Credentials

References

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).

Rule body

id: '24482.45161'
title: WDigest Forced Credential Caching
description: 'WDigest is a legacy authentication protocol used by Windows, primarily
  for backward compatibility, that stores credentials in memory, potentially allowing
  plaintext password access if enabled. Threat actors may adjust wdigest registry
  values to facilitate credential harvesting. This use case detects commands to modify
  the WDigest registry value. '
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR
  "<EventID>4104<") "add" "\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\WDigest"
  "UseLogonCredential" | table _time, host, user signature_id, process, process_*
  | bin span=1s | stats values(*) as * by _time, host '
techniques:
- defense-evasion:modify registry
- credential-access:os credential dumping:cached domain credentials
technique_id:
- T1112
- T1003.005
data_category:
- PowerShell logs
references:
- https://www.microsoft.com/en-us/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/
- https://blog.talosintelligence.com/lazarus-three-rats/
- https://www.huntress.com/blog/third-party-pharmaceutical-vendor-linked-to-pharmacy-and-health-clinic-cyberattack
- https://twitter.com/Purp1eW0lf/status/1735588467092922707/photo/1

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4104) OR "<EventID>4104<") "add" "\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\WDigest" "UseLogonCredential"

Stage 2: `table`

| table _time, host, user signature_id, process, process_*

Stage 3: `bucket`

| bin span=1s

Stage 4: `stats`

| stats values(*) as * by _time, host

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`4104` corpus 269 (splunk 269)	`field:"EventID" kind:eq value:"4104"`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"<EventID>4104<"`
1	`"add"`
1	`"\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\WDigest"`
1	`"UseLogonCredential"`