Winlogon CachedLogonsCount Registry Value Set To Zero

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects registry set events where the CachedLogonsCount value under the Winlogon key is set to zero. This disables Windows cached domain credentials, forcing direct domain controller authentication. Threat actors may abuse this to prevent offline authentication or to hinder forensic credential recovery post-compromise.

2026-05-04 00:00:00

None

ac235f2e-6fcb-46cf-b25d-78f37df9ebe7

attack.defense-impairment attack.persistence attack.t1112

Nextron Sigma feed only (private)