0

I want to know under which case would Mimikatz still run despite disabling WDigest?

Whether wdigest is set to 1 or 0, mimikatz still worked. (tested on Windows 7, 8, 2012)

Is there a better way to block it specifically on the OS level?

Improve this question

1 Answer 1

Reset to default
2

WDigest isn't a setting which disables Mimikatz, it's a form of encryption supported by Windows, which when enabled, allows Mimikatz to very easily dump plaintext passwords.

Disabling WDigest removes that one type of credential from memory, but a user with Administrator-level privileges can still dump other forms of interesting credentials. Mimikatz has plenty of additional capabilities which don't rely on WDigest!

So what you're really asking looks like a meta-question: How do I stop unwanted software running on my computers?

And in short, the answer is to either enable security features available to you:

  • Application whitelisting (AppLocker)
  • Antivirus software which detects potentially unwanted applications
  • Device hardening (particularly BitLocker (to prevent access to offline file systems) and if you can use Windows 10, Credential Guard)
  • Reduction in user privileges (don't let users be Admins)

Or potentially require use of Windows 10 S Mode or a device which can only run Store-derived software (and lock the selection down).

Preventing any kind of unwanted software (like malware) requires a holistic approach.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .