
title: Wdigest CredGuard Registry Modification
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
date: 2019/08/25
description: Detects potential malicious modification of the property value of IsCredGuardEnabled
  from HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to disable
  Cred Guard on a system. This is usually used with UseLogonCredential to manipulate
  the caching credentials.
detection:
  SELECTION_1:
    EventID: 12
  SELECTION_2:
    EventID: 13
  SELECTION_3:
    EventID: 14
  SELECTION_4:
    TargetObject: '*\IsCredGuardEnabled'
  condition: ((SELECTION_1 or SELECTION_2 or SELECTION_3) and SELECTION_4)
falsepositives:
- Unknown
id: 1a2d6c47-75b0-45bd-b133-2c0be75349fd
level: critical
logsource:
  category: registry_event
  product: windows
references:
- https://teamhydra.blog/2020/08/25/bypassing-credential-guard/
status: experimental
tags:
- attack.defense_evasion
- attack.t1112
ruletype: SIGMA
