Windows.Registry.WDigest

Scans HKLM\SYSTEM ControlSets for WDigest security provider registry keys that enable credential harvesting.

The artifact will also use GROUP BY to limit all ControlSet output to a single row.

To prevent a clear-text password from being placed in LSASS, the following registry key needs to be set to “0” (Digest Disabled):

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest “UseLogonCredential”(DWORD) “Negotiate”(DWORD)

These registry keys are worth monitoring in an environment as an attacker may wish to set it to 1 to enable Digest password support which forces “clear-text” passwords to be placed in LSASS on any version of Windows from Windows 7 / 2008R2 up to Windows 10 / 2012R2. Furthermore, Windows 8.1 / 2012 R2 and newer do not have a “UseLogonCredential” DWORD value, so the key needs to be added. The existence of the key is suspicious, if not expected.

ATT&CK tactic: Defense Evasion, Credential Access
ATT&CK technique: T1112, T1003.001

name: Windows.Registry.WDigest
author: Eduardo Mattos - @eduardfir, Matt Green - @mgreen27
description: |
  Scans HKLM\SYSTEM ControlSets for WDigest security provider
  registry keys that enable credential harvesting.

  The artifact will also use GROUP BY to limit all ControlSet output
  to a single row.

  To prevent a clear-text password from being placed in
  LSASS, the following registry key needs to be set to “0” (Digest
  Disabled):

  - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest
    “UseLogonCredential”(DWORD)
    “Negotiate”(DWORD)

  These registry keys are worth monitoring in an environment as an
  attacker may wish to set it to 1 to enable Digest password support
  which forces “clear-text” passwords to be placed in LSASS on any
  version of Windows from Windows 7 / 2008R2 up to Windows 10 /
  2012R2. Furthermore, Windows 8.1 / 2012 R2 and newer do not have a
  “UseLogonCredential” DWORD value, so the key needs to be added.
  The existence of the key is suspicious, if not expected.

  * ATT&CK tactic: Defense Evasion, Credential Access
  * ATT&CK technique: T1112, T1003.001

reference:
    - https://medium.com/blue-team/preventing-mimikatz-attacks-ed283e7ebdd5

type: CLIENT
precondition:
  SELECT * FROM info() where OS = 'windows'

parameters:
  - name: WDigestGlob
    default: HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Control\SecurityProviders\WDigest\**
    description: Use a glob to define the files that will be searched.
  - name: ShowAllValues
    type: bool
    description: Show all key values. It may be suspicious if these keys exist.


sources:
  - query: |
        SELECT
            ModTime as LastModified,
            OSPath as KeyPath,
            Name as KeyName,
            Data.type as KeyType,
            Data.value as KeyValue
        FROM glob(globs=WDigestGlob, accessor="registry")
        WHERE KeyType = "DWORD"
            AND KeyName =~ "UseLogonCredential|Negotiate"
            AND NOT if(condition= ShowAllValues,
                        then= False,
                        else= KeyValue = 0)
        GROUP BY LastModified, KeyName, KeyType, KeyValue,
            regex_replace(source=OSPath,
                re='''[^\\]+ControlSet[^\\]+''',replace='CurrentControlSet')

column_types:
  - name: LastModified
    type: timestamp