KQL Search

name : Credential Access - WDigest credential harvesting
description : 
- Case1 - Find attempts to turn on WDigest credential caching
- Case2 - Find processes created with commandlines that attempt to turn on WDigest caching
reference : 
- Threat analytics | WDigest credential harvesting
- https://learn.microsoft.com/en-us/microsoft-365/security/defender/threat-analytics?view=o365-worldwide
table : 
- DeviceRegistryEvents
- https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-deviceregistryevents-table?view=o365-worldwide
- DeviceProcessEvents
- https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-deviceprocessevents-table?view=o365-worldwide
query : |
    //Case1 - Find attempts to turn on WDigest credential caching
    DeviceRegistryEvents
    | where Timestamp  > ago(7d)
    | where RegistryKey contains "wdigest" and RegistryValueName == "UseLogonCredential" and RegistryValueData == "1" or 
    | project Timestamp, DeviceId, DeviceName, PreviousRegistryValueData, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName


    //Case2 - Find processes created with commandlines that attempt to turn on WDigest caching
    DeviceProcessEvents
    | where Timestamp  > ago(7d)
    | where ProcessCommandLine has "WDigest" and ProcessCommandLine has "UseLogonCredential" and ProcessCommandLine has "dword" and ProcessCommandLine has "1"
    | project Timestamp, DeviceId, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName, FileName, ProcessCommandLine