Winlogon CachedLogonsCount Registry Manipulation Via CLI

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects command-line manipulation of the CachedLogonsCount registry value under the Winlogon key through commandline. This value controls how many domain credential sets Windows caches locally. Setting it to zero disables caching entirely, forcing direct domain controller authentication. Threat actors may abuse this to prevent offline authentication or to hinder forensic credential recovery post-compromise.

2026-05-04 00:00:00

None

7c2e4f91-b3a8-4d6e-9f05-e8c1b2a74d38

attack.defense-impairment attack.persistence attack.t1112

Nextron Sigma feed only (private)