detection.wiki

Detection rules › Sigma

HackTool - Windows Credential Editor (WCE) Execution

Status
test
Severity
critical
Log source
product windows, category process_creation
Author
Florian Roth (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects the use of Windows Credential Editor (WCE), a popular post-exploitation tool used to extract plaintext passwords, hash, PIN code and Kerberos tickets from memory. It is often used by threat actors for credential dumping and lateral movement within compromised networks.

MITRE ATT&CK coverage

TacticTechniques
Credential AccessT1003.001 OS Credential Dumping: LSASS Memory

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: HackTool - Windows Credential Editor (WCE) Execution
id: 7aa7009a-28b9-4344-8c1f-159489a390df
status: test
description: |
    Detects the use of Windows Credential Editor (WCE), a popular post-exploitation tool used to extract plaintext passwords, hash, PIN code and Kerberos tickets from memory.
    It is often used by threat actors for credential dumping and lateral movement within compromised networks.
references:
    - https://www.ampliasecurity.com/research/windows-credentials-editor/
author: Florian Roth (Nextron Systems)
date: 2019-12-31
modified: 2025-10-21
tags:
    - attack.credential-access
    - attack.t1003.001
    - attack.s0005
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\WCE.exe'
            - '\WCE64.exe'
    selection_hash:
        Hashes|contains:
            - 'IMPHASH=136F0A8572C058A96436C82E541E4C41'
            - 'IMPHASH=589657C64DDE88533186C39F82FA1F50'
            - 'IMPHASH=6BFE09EFCB4FFDE061EBDBAFC4DB84CF'
            - 'IMPHASH=7D490037BF450877E6D0287BDCFF8D2E'
            - 'IMPHASH=8AB93B061287C79F3088C5BC7E7D97ED'
            - 'IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F'
            - 'IMPHASH=BA434A7A729EEC20E136CA4C32D6C740'
            - 'IMPHASH=BD1D1547DA13C0FCB6C15E86217D5EB8'
            - 'IMPHASH=E96A73C7BF33A464C510EDE582318BF2'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: critical

Stages and Predicates

Stage 0: condition

1 of selection_*

Stage 1: selection_img

selection_img:
    Image|endswith:
        - '\WCE.exe'
        - '\WCE64.exe'

Stage 2: selection_hash

selection_hash:
    Hashes|contains:
        - 'IMPHASH=136F0A8572C058A96436C82E541E4C41'
        - 'IMPHASH=589657C64DDE88533186C39F82FA1F50'
        - 'IMPHASH=6BFE09EFCB4FFDE061EBDBAFC4DB84CF'
        - 'IMPHASH=7D490037BF450877E6D0287BDCFF8D2E'
        - 'IMPHASH=8AB93B061287C79F3088C5BC7E7D97ED'
        - 'IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F'
        - 'IMPHASH=BA434A7A729EEC20E136CA4C32D6C740'
        - 'IMPHASH=BD1D1547DA13C0FCB6C15E86217D5EB8'
        - 'IMPHASH=E96A73C7BF33A464C510EDE582318BF2'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Hashesmatch
  • IMPHASH=136F0A8572C058A96436C82E541E4C41
  • IMPHASH=589657C64DDE88533186C39F82FA1F50
  • IMPHASH=6BFE09EFCB4FFDE061EBDBAFC4DB84CF
  • IMPHASH=7D490037BF450877E6D0287BDCFF8D2E
  • IMPHASH=8AB93B061287C79F3088C5BC7E7D97ED
  • IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F corpus 3 (sigma 3)
  • IMPHASH=BA434A7A729EEC20E136CA4C32D6C740
  • IMPHASH=BD1D1547DA13C0FCB6C15E86217D5EB8
  • IMPHASH=E96A73C7BF33A464C510EDE582318BF2 corpus 3 (sigma 3)
Imageends_with
  • \WCE.exe
  • \WCE64.exe