wdigest-caching

Description

This query was originally published in the threat analytics report, WDigest credential harvesting. WDigest is a legacy authentication protocol dating from Windows XP. While still used on some corporate networks, this protocol can be manipulated by attackers to dump system credentials. The Microsoft Security Response Center published an overview of KB2871997, which addresses WDigest use on older platforms. More recent versions of Windows can be protected with a holistic security approach that follows the principle of least privilege. The following query returns any attempts to turn WDigest credential caching on through the registry. References: https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2003/cc778868(v=ws.10)?redirectedfrom=MSDN https://msrc-blog.microsoft.com/2014/06/05/an-overview-of-kb2871997/ https://www.catalog.update.microsoft.com/Search.aspx?q=KB2871997 https://docs.microsoft.com/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models

Query · kql

union DeviceRegistryEvents, DeviceProcessEvents
// Find attempts to turn on WDigest credential caching
| where RegistryKey contains "wdigest" and RegistryValueName == "UseLogonCredential" and 
RegistryValueData == "1" or 
// Find processes created with commandlines that attempt to turn on WDigest caching
ProcessCommandLine has "WDigest" and ProcessCommandLine has "UseLogonCredential" and 
ProcessCommandLine has "dword" and ProcessCommandLine has "1"
| project Timestamp, DeviceName, PreviousRegistryValueData,  
RegistryKey, RegistryValueName, RegistryValueData, FileName, ProcessCommandLine, 
InitiatingProcessAccountName, InitiatingProcessFileName, 
InitiatingProcessCommandLine, InitiatingProcessParentFileName
Raw source wdigest-caching · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 05a01ec8-ecab-4f9a-9aae-8d8cc061fe05
name: wdigest-caching
description: |
  This query was originally published in the threat analytics report, WDigest credential harvesting.
  WDigest is a legacy authentication protocol dating from Windows XP. While still used on some corporate networks, this protocol can be manipulated by attackers to dump system credentials.
  The Microsoft Security Response Center published an overview of KB2871997, which addresses WDigest use on older platforms. More recent versions of Windows can be protected with a holistic security approach that follows the principle of least privilege.
  The following query returns any attempts to turn WDigest credential caching on through the registry.
  References:
  https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2003/cc778868(v=ws.10)?redirectedfrom=MSDN
  https://msrc-blog.microsoft.com/2014/06/05/an-overview-of-kb2871997/
  https://www.catalog.update.microsoft.com/Search.aspx?q=KB2871997
  https://docs.microsoft.com/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceRegistryEvents
  - DeviceProcessEvents
tactics:
- Credential Access
- Vulnerability
query: |
  union DeviceRegistryEvents, DeviceProcessEvents
  // Find attempts to turn on WDigest credential caching
  | where RegistryKey contains "wdigest" and RegistryValueName == "UseLogonCredential" and 
  RegistryValueData == "1" or 
  // Find processes created with commandlines that attempt to turn on WDigest caching
  ProcessCommandLine has "WDigest" and ProcessCommandLine has "UseLogonCredential" and 
  ProcessCommandLine has "dword" and ProcessCommandLine has "1"
  | project Timestamp, DeviceName, PreviousRegistryValueData,  
  RegistryKey, RegistryValueName, RegistryValueData, FileName, ProcessCommandLine, 
  InitiatingProcessAccountName, InitiatingProcessFileName, 
  InitiatingProcessCommandLine, InitiatingProcessParentFileName

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.