Windows Registry: Modification of WDigest IsCredGuardEnabled to Disable Credential Guard
Alerts on Windows registry changes to WDigest\IsCredGuardEnabled that may disable Credential Guard.
FreeUnreviewedSigmahighv1
windows-registry-modification-of-wdigest-iscredguardenabled-to-disable-credentia-1a2d6c47
title: "Windows Registry: Modification of WDigest IsCredGuardEnabled to Disable Credential Guard"
id: 27461f97-7592-4c63-bb96-7df33819e02f
status: test
description: This rule identifies registry activity where the value targeting IsCredGuardEnabled under the WDigest security provider path is modified. Disabling Credential Guard can weaken defenses by enabling credential-related behaviors attackers may leverage for persistence or credential access. It relies on Windows registry event telemetry capturing the TargetObject path that ends with '\IsCredGuardEnabled'.
references:
- https://teamhydra.blog/2020/08/25/bypassing-credential-guard/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_disable_wdigest_credential_guard.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2019-08-25
modified: 2021-11-27
tags:
- attack.persistence
- attack.defense-impairment
- attack.t1112
logsource:
category: registry_event
product: windows
detection:
selection:
TargetObject|endswith: \IsCredGuardEnabled
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 1a2d6c47-75b0-45bd-b133-2c0be75349fd
type: derived
What it detects
This rule identifies registry activity where the value targeting IsCredGuardEnabled under the WDigest security provider path is modified. Disabling Credential Guard can weaken defenses by enabling credential-related behaviors attackers may leverage for persistence or credential access. It relies on Windows registry event telemetry capturing the TargetObject path that ends with '\IsCredGuardEnabled'.
Known false positives
- Unknown
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.