On a Windows endpoint, review the registry write events to spot when the WDigest key is altered to permit plaintext credential storage. What registry value name was changed?

DeviceRegistryEvents
| where ActionType == 'RegistryValueSet'
| where RegistryKey has 'WDigest'
| project DeviceName, TimeGenerated, InitiatingProcessCommandLine, RegistryKey, RegistryValueName, RegistryValueData

DeviceRegistryEvents
| where tostring(ActionType) in~ ("RegistryValueSet", "RegistryValueAdd", "RegistryKeyCreated")
| where tolower(RegistryKey) contains "wdigest" or tolower(PreviousRegistryKey) contains "wdigest"
| where tolower(RegistryValueName) == "uselogoncredential" or tolower(PreviousRegistryValueName) == "uselogoncredential"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RegistryKey, RegistryValueName, PreviousRegistryValueName, RegistryValueData, PreviousRegistryValueData, ActionType
| order by TimeGenerated desc

DeviceRegistryEvents
| where RegistryKey has "SecurityProviders\\WDigest"
| summarize count() by  RegistryValueName

DeviceRegistryEvents
| where ActionType in ("RegistryValueSet", "RegistryValueUpdate")
| where RegistryKey has "Wdigest"
| project TimeGenerated, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessAccountName
| order by TimeGenerated desc

let wdigestPathRegex = @"\\system\\(currentcontrolset|controlset\d+)\\control\\securityproviders\\wdigest";
DeviceRegistryEvents
| where ActionType in~ ("RegistryValueSet","RegistryValueCreated","RegistryValueModified")
| where tolower(RegistryKey) matches regex wdigestPathRegex
| extend NewVal = tostring(RegistryValueData), OldVal = tostring(PreviousRegistryValueData)
// Enablement occurs when UseLogonCredential is set to 1 (from 0/blank)
| where RegistryValueName =~ "UseLogonCredential" and NewVal in~ ("1","0x00000001") and OldVal !in~ ("1","0x00000001")
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, PreviousRegistryValueData, RegistryValueData, ActionType,
          InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

DeviceRegistryEvents
| where ActionType has_any ("SetValue", "RegSetValue", "SetValueKey", "Modify", "Updated", "Create")
// Filter for registry keys containing "wdigest" (case-insensitive)
| where tolower(RegistryKey) contains "wdigest"
// Look for the specific value name UseLogonCredential (current or previous)
| where tostring(RegistryValueName) == "UseLogonCredential" or tostring(PreviousRegistryValueName) == "UseLogonCredential"
// Also include partial matches like "uselogon" for broader detection
| union (
    DeviceRegistryEvents
    | where tolower(RegistryKey) contains "wdigest"
    | where tolower(tostring(RegistryValueName)) contains "uselogon" or tolower(tostring(PreviousRegistryValueName)) contains "uselogon"
)
| project TimeGenerated, DeviceName, DeviceId, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessAccountDomain, ActionType, RegistryKey, RegistryValueName, RegistryValueType, RegistryValueData, PreviousRegistryValueName, PreviousRegistryValueData
| sort by TimeGenerated desc
| limit 200

DeviceRegistryEvents
| where ActionType == 'RegistryValueSet'
| where RegistryKey has 'WDigest'
| where RegistryValueName == 'UseLogonCredential'
| where RegistryValueData contains '1'
| project Timestamp, DeviceId, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessAccountDomain
| order by Timestamp desc

DeviceRegistryEvents
| where RegistryKey has "WDigest"
| where ActionType == "RegistryValueSet"
| where RegistryValueName == "UseLogonCredential" and RegistryValueData == "1"
| project RegistryValueName, TimeGenerated, DeviceName

DeviceRegistryEvents
| where RegistryKey has "WDigest"
| where ActionType in ("RegistryValueSet", "RegistryValueModified", "RegistryValueCreated")
| project TimeGenerated, DeviceName, ActionType, RegistryKey, PreviousRegistryValueName, PreviousRegistryValueData,
          RegistryValueName, RegistryValueData, InitiatingProcessAccountName, InitiatingProcessCommandLine
| order by TimeGenerated desc

DeviceRegistryEvents
| where RegistryKey has "WDigest"
| where ActionType in~ ("RegistryValueSet", "RegistryValueModified", "RegistryValueWrite")
| project TimeGenerated, DeviceName, ActionType, RegistryKey, RegistryValueName, PreviousRegistryValueData, RegistryValueData, InitiatingProcessFileName, InitiatingProcessAccountName
| order by TimeGenerated desc

DeviceRegistryEvents
| where RegistryKey contains "WDigest"
| where ActionType contains "Value"
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, PreviousRegistryValueName
| sort by TimeGenerated asc

// If you're only interested in unique registry value names that were changed, use the following:
// | summarize ChangedValues = make_set(RegistryValueName)

DeviceRegistryEvents
| where RegistryKey has "WDigest"
| where ActionType in ("RegistryValueSet", "RegistryValueModified")
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, ActionType
| order by TimeGenerated desc

DeviceRegistryEvents
| where ActionType == "RegistryValueSet"
| where RegistryKey has "\\Control\\SecurityProviders\\WDigest"
| where PreviousRegistryValueData == "0" and RegistryValueData == "1"
| distinct RegistryValueName

DeviceRegistryEvents
| where ActionType == "RegistryValueSet"
| where tolower(RegistryKey) has "\\control\\securityproviders\\wdigest"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, RegistryKey, PreviousRegistryValueName, RegistryValueName, PreviousRegistryValueData, RegistryValueData
| sort by TimeGenerated desc