0

I want to know under which case would Mimikatz still run despite disabling WDigest?

Whether wdigest is set to 1 or 0, mimikatz still worked. (tested on Windows 7, 8, 2012)

Is there a better way to block it specifically on the OS level?

2

WDigest isn't a setting which disables Mimikatz, it's a form of encryption supported by Windows, which when enabled, allows Mimikatz to very easily dump plaintext passwords.

Disabling WDigest removes that one type of credential from memory, but a user with Administrator-level privileges can still dump other forms of interesting credentials. Mimikatz has plenty of additional capabilities which don't rely on WDigest!

So what you're really asking looks like a meta-question: How do I stop unwanted software running on my computers?

And in short, the answer is to either enable security features available to you:

  • Application whitelisting (AppLocker)
  • Antivirus software which detects potentially unwanted applications
  • Device hardening (particularly BitLocker (to prevent access to offline file systems) and if you can use Windows 10, Credential Guard)
  • Reduction in user privileges (don't let users be Admins)

Or potentially require use of Windows 10 S Mode or a device which can only run Store-derived software (and lock the selection down).

Preventing any kind of unwanted software (like malware) requires a holistic approach.

  • thank you so much for your informative response! – secdos9 Aug 28 at 4:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.