HackTool - Windows Credential Editor (WCE) Execution

Status: test
Severity: critical
Log source: category process_creation, product windows
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the use of Windows Credential Editor (WCE), a popular post-exploitation tool used to extract plaintext passwords, hash, PIN code and Kerberos tickets from memory. It is often used by threat actors for credential dumping and lateral movement within compromised networks.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003.001` OS Credential Dumping: LSASS Memory

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: HackTool - Windows Credential Editor (WCE) Execution
id: 7aa7009a-28b9-4344-8c1f-159489a390df
status: test
description: |
    Detects the use of Windows Credential Editor (WCE), a popular post-exploitation tool used to extract plaintext passwords, hash, PIN code and Kerberos tickets from memory.
    It is often used by threat actors for credential dumping and lateral movement within compromised networks.
references:
    - https://www.ampliasecurity.com/research/windows-credentials-editor/
author: Florian Roth (Nextron Systems)
date: 2019-12-31
modified: 2025-10-21
tags:
    - attack.credential-access
    - attack.t1003.001
    - attack.s0005
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\WCE.exe'
            - '\WCE64.exe'
    selection_hash:
        Hashes|contains:
            - 'IMPHASH=136F0A8572C058A96436C82E541E4C41'
            - 'IMPHASH=589657C64DDE88533186C39F82FA1F50'
            - 'IMPHASH=6BFE09EFCB4FFDE061EBDBAFC4DB84CF'
            - 'IMPHASH=7D490037BF450877E6D0287BDCFF8D2E'
            - 'IMPHASH=8AB93B061287C79F3088C5BC7E7D97ED'
            - 'IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F'
            - 'IMPHASH=BA434A7A729EEC20E136CA4C32D6C740'
            - 'IMPHASH=BD1D1547DA13C0FCB6C15E86217D5EB8'
            - 'IMPHASH=E96A73C7BF33A464C510EDE582318BF2'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: critical

Stages and Predicates

Stage 0: `condition`

1 of selection_*

Stage 1: `selection_img`

selection_img:
    Image|endswith:
        - '\WCE.exe'
        - '\WCE64.exe'

Stage 2: `selection_hash`

selection_hash:
    Hashes|contains:
        - 'IMPHASH=136F0A8572C058A96436C82E541E4C41'
        - 'IMPHASH=589657C64DDE88533186C39F82FA1F50'
        - 'IMPHASH=6BFE09EFCB4FFDE061EBDBAFC4DB84CF'
        - 'IMPHASH=7D490037BF450877E6D0287BDCFF8D2E'
        - 'IMPHASH=8AB93B061287C79F3088C5BC7E7D97ED'
        - 'IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F'
        - 'IMPHASH=BA434A7A729EEC20E136CA4C32D6C740'
        - 'IMPHASH=BD1D1547DA13C0FCB6C15E86217D5EB8'
        - 'IMPHASH=E96A73C7BF33A464C510EDE582318BF2'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Hashes`	match	`IMPHASH=136F0A8572C058A96436C82E541E4C41` `IMPHASH=589657C64DDE88533186C39F82FA1F50` `IMPHASH=6BFE09EFCB4FFDE061EBDBAFC4DB84CF` `IMPHASH=7D490037BF450877E6D0287BDCFF8D2E` `IMPHASH=8AB93B061287C79F3088C5BC7E7D97ED` `IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F` corpus 3 (sigma 3) `IMPHASH=BA434A7A729EEC20E136CA4C32D6C740` `IMPHASH=BD1D1547DA13C0FCB6C15E86217D5EB8` `IMPHASH=E96A73C7BF33A464C510EDE582318BF2` corpus 3 (sigma 3)	`field:"Hashes" kind:match`
`Image`	ends_with	`\WCE.exe` `\WCE64.exe`	`field:"Image" kind:ends_with`