On a Windows endpoint, review the registry write events to spot when the WDigest key is altered to permit plaintext credential storage. What registry value name was changed?

DeviceRegistryEvents | where ActionType == 'RegistryValueSet' | where RegistryKey has 'WDigest' | project DeviceName, TimeGenerated, InitiatingProcessCommandLine, RegistryKey, RegistryValueName, RegistryValueData

DeviceRegistryEvents | where tostring(ActionType) in~ ("RegistryValueSet", "RegistryValueAdd", "RegistryKeyCreated") | where tolower(RegistryKey) contains "wdigest" or tolower(PreviousRegistryKey) contains "wdigest" | where tolower(RegistryValueName) == "uselogoncredential" or tolower(PreviousRegistryValueName) == "uselogoncredential" | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RegistryKey, RegistryValueName, PreviousRegistryValueName, RegistryValueData, PreviousRegistryValueData, ActionType | order by TimeGenerated desc

DeviceRegistryEvents | where RegistryKey has "SecurityProviders\\WDigest" | summarize count() by RegistryValueName

DeviceRegistryEvents | where ActionType in ("RegistryValueSet", "RegistryValueUpdate") | where RegistryKey has "Wdigest" | project TimeGenerated, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessAccountName | order by TimeGenerated desc

let wdigestPathRegex = @"\\system\\(currentcontrolset|controlset\d+)\\control\\securityproviders\\wdigest"; DeviceRegistryEvents | where ActionType in~ ("RegistryValueSet","RegistryValueCreated","RegistryValueModified") | where tolower(RegistryKey) matches regex wdigestPathRegex | extend NewVal = tostring(RegistryValueData), OldVal = tostring(PreviousRegistryValueData) // Enablement occurs when UseLogonCredential is set to 1 (from 0/blank) | where RegistryValueName =~ "UseLogonCredential" and NewVal in~ ("1","0x00000001") and OldVal !in~ ("1","0x00000001") | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, PreviousRegistryValueData, RegistryValueData, ActionType, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine | order by TimeGenerated desc

DeviceRegistryEvents | where ActionType has_any ("SetValue", "RegSetValue", "SetValueKey", "Modify", "Updated", "Create") // Filter for registry keys containing "wdigest" (case-insensitive) | where tolower(RegistryKey) contains "wdigest" // Look for the specific value name UseLogonCredential (current or previous) | where tostring(RegistryValueName) == "UseLogonCredential" or tostring(PreviousRegistryValueName) == "UseLogonCredential" // Also include partial matches like "uselogon" for broader detection | union ( DeviceRegistryEvents | where tolower(RegistryKey) contains "wdigest" | where tolower(tostring(RegistryValueName)) contains "uselogon" or tolower(tostring(PreviousRegistryValueName)) contains "uselogon" ) | project TimeGenerated, DeviceName, DeviceId, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessAccountDomain, ActionType, RegistryKey, RegistryValueName, RegistryValueType, RegistryValueData, PreviousRegistryValueName, PreviousRegistryValueData | sort by TimeGenerated desc | limit 200

DeviceRegistryEvents | where ActionType == 'RegistryValueSet' | where RegistryKey has 'WDigest' | where RegistryValueName == 'UseLogonCredential' | where RegistryValueData contains '1' | project Timestamp, DeviceId, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessAccountDomain | order by Timestamp desc

DeviceRegistryEvents | where RegistryKey has "WDigest" | where ActionType == "RegistryValueSet" | where RegistryValueName == "UseLogonCredential" and RegistryValueData == "1" | project RegistryValueName, TimeGenerated, DeviceName

DeviceRegistryEvents | where RegistryKey has "WDigest" | where ActionType in ("RegistryValueSet", "RegistryValueModified", "RegistryValueCreated") | project TimeGenerated, DeviceName, ActionType, RegistryKey, PreviousRegistryValueName, PreviousRegistryValueData, RegistryValueName, RegistryValueData, InitiatingProcessAccountName, InitiatingProcessCommandLine | order by TimeGenerated desc

DeviceRegistryEvents | where RegistryKey has "WDigest" | where ActionType in~ ("RegistryValueSet", "RegistryValueModified", "RegistryValueWrite") | project TimeGenerated, DeviceName, ActionType, RegistryKey, RegistryValueName, PreviousRegistryValueData, RegistryValueData, InitiatingProcessFileName, InitiatingProcessAccountName | order by TimeGenerated desc

DeviceRegistryEvents | where RegistryKey contains "WDigest" | where ActionType contains "Value" | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, PreviousRegistryValueName | sort by TimeGenerated asc // If you're only interested in unique registry value names that were changed, use the following: // | summarize ChangedValues = make_set(RegistryValueName)

DeviceRegistryEvents | where RegistryKey has "WDigest" | where ActionType in ("RegistryValueSet", "RegistryValueModified") | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, ActionType | order by TimeGenerated desc

DeviceRegistryEvents | where ActionType == "RegistryValueSet" | where RegistryKey has "\\Control\\SecurityProviders\\WDigest" | where PreviousRegistryValueData == "0" and RegistryValueData == "1" | distinct RegistryValueName

DeviceRegistryEvents | where ActionType == "RegistryValueSet" | where tolower(RegistryKey) has "\\control\\securityproviders\\wdigest" | project TimeGenerated, DeviceName, InitiatingProcessAccountName, RegistryKey, PreviousRegistryValueName, RegistryValueName, PreviousRegistryValueData, RegistryValueData | sort by TimeGenerated desc