detection.wiki

Detection rules › Sigma

CredUI.DLL Loaded By Uncommon Process

Status
test
Severity
medium
Log source
product windows, category image_load
Author
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Source
github.com/SigmaHQ/sigma

Detects loading of "credui.dll" and related DLLs by an uncommon process. Attackers might leverage this DLL for potential use of "CredUIPromptForCredentials" or "CredUnPackAuthenticationBufferW".

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1056.002 Input Capture: GUI Input Capture
CollectionT1056.002 Input Capture: GUI Input Capture

Event coverage

ProviderEventTitle
SysmonEvent ID 7Image loaded

Rule body yaml

title: CredUI.DLL Loaded By Uncommon Process
id: 9ae01559-cf7e-4f8e-8e14-4c290a1b4784
status: test
description: Detects loading of "credui.dll" and related DLLs by an uncommon process. Attackers might leverage this DLL for potential use of "CredUIPromptForCredentials" or "CredUnPackAuthenticationBufferW".
references:
    - https://securitydatasets.com/notebooks/atomic/windows/credential_access/SDWIN-201020013208.html
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.002/T1056.002.md#atomic-test-2---powershell---prompt-user-for-password
    - https://learn.microsoft.com/en-us/windows/win32/api/wincred/nf-wincred-creduipromptforcredentialsa
    - https://github.com/S12cybersecurity/RDPCredentialStealer
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
date: 2020-10-20
modified: 2025-12-09
tags:
    - attack.credential-access
    - attack.collection
    - attack.t1056.002
logsource:
    category: image_load
    product: windows
detection:
    selection:
        - ImageLoaded|endswith:
              - '\credui.dll'
              - '\wincredui.dll'
        - OriginalFileName:
              - 'credui.dll'
              - 'wincredui.dll'
    filter_main_generic:
        Image|startswith:
            - 'C:\Program Files (x86)\'
            - 'C:\Program Files\'
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
            - 'C:\Windows\SystemApps\'
    filter_main_full:
        Image:
            - 'C:\Windows\explorer.exe'
            - 'C:\Windows\ImmersiveControlPanel\SystemSettings.exe'
            - 'C:\Windows\regedit.exe' # This FP is triggered for example when choosing the "Connect Network Registry" from the menu
    filter_optional_opera:
        Image|endswith: '\opera_autoupdate.exe'
    filter_optional_process_explorer:
        Image|endswith:
            - '\procexp64.exe'
            - '\procexp.exe'
    filter_optional_teams:
        Image|startswith: 'C:\Users\'
        Image|contains: '\AppData\Local\Microsoft\Teams\'
        Image|endswith: '\Teams.exe'
    filter_optional_onedrive:
        Image|startswith: 'C:\Users\'
        Image|contains: '\AppData\Local\Microsoft\OneDrive\'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Other legitimate processes loading those DLLs in your environment.
level: medium

Stages and Predicates

Stage 0: condition

selection and not 1 of filter_main_* and not 1 of filter_optional_*

Stage 1: selection

selection:
    - ImageLoaded|endswith:
          - '\credui.dll'
          - '\wincredui.dll'
    - OriginalFileName:
          - 'credui.dll'
          - 'wincredui.dll'

Stage 2: not filter_main_*

filter_main_generic:
    Image|startswith:
        - 'C:\Program Files (x86)\'
        - 'C:\Program Files\'
        - 'C:\Windows\System32\'
        - 'C:\Windows\SysWOW64\'
        - 'C:\Windows\SystemApps\'
filter_main_full:
    Image:
        - 'C:\Windows\explorer.exe'
        - 'C:\Windows\ImmersiveControlPanel\SystemSettings.exe'
        - 'C:\Windows\regedit.exe'

Stage 3: not filter_optional_*

filter_optional_opera:
    Image|endswith: '\opera_autoupdate.exe'
filter_optional_process_explorer:
    Image|endswith:
        - '\procexp64.exe'
        - '\procexp.exe'
filter_optional_teams:
    Image|startswith: 'C:\Users\'
    Image|contains: '\AppData\Local\Microsoft\Teams\'
    Image|endswith: '\Teams.exe'
filter_optional_onedrive:
    Image|startswith: 'C:\Users\'
    Image|contains: '\AppData\Local\Microsoft\OneDrive\'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
ImageeqC:\Windows\ImmersiveControlPanel\SystemSettings.exe
ImageeqC:\Windows\explorer.exe
ImageeqC:\Windows\regedit.exe
Imagestarts_withC:\Program Files (x86)\
Imagestarts_withC:\Program Files\
Imagestarts_withC:\Windows\SysWOW64\
Imagestarts_withC:\Windows\System32\
Imagestarts_withC:\Windows\SystemApps\
Imageends_with\Teams.exe
Imagematch\AppData\Local\Microsoft\Teams\
Imagestarts_withC:\Users\
Imagematch\AppData\Local\Microsoft\OneDrive\
Imagestarts_withC:\Users\
Imageends_with\opera_autoupdate.exe
Imageends_with\procexp.exe
Imageends_with\procexp64.exe

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ImageLoadedends_with
  • \credui.dll corpus 2 (sigma 2)
  • \wincredui.dll
OriginalFileNameeq
  • credui.dll corpus 2 (sigma 1, splunk 1)
  • wincredui.dll corpus 2 (sigma 1, splunk 1)