WdToggle is a Proof of Concept Cobalt Strike Beacon Object File which uses direct system calls to enable WDigest credential caching and circumvent Credential Guard (if enabled). What is this repository for? Demonstrate the usage of direct systems calls using inline-assembly to provide a more opsec safe way of interacting with the LSASS process. Enable …
Continue reading “WdToggle : Direct System Calls To Enable WDigest Credential Caching”