Query: detection rule: Detects the use of Windows Credential Editor (WCE), a popular post-exploitation tool used to extract plaintext passwords
Matching passage: Sigma rule: Detects the use of Windows Credential Editor (WCE), a popular post-exploitation tool used to extract plaintext passwords. Logsource: windows / process_creation. Rule: title: HackTool - Windows Credential Editor (WCE) Execution id: 7aa7009a-28b9-4344-8c1f-159489a390df status: test description: 'Detects the use of Windows Credential Editor (WCE), a popular post-exploitation tool used to extract plaintext passwords, hash, PIN code and Kerberos tickets from memory. It is often used by threat actors for credential dumping and lateral movement within compromised networks. ' references: - https://www.ampliasecurity.com/research/windows-credentials-editor/ author: Florian Roth (Nextron Systems) date: 2019-12-31 modified: 2025-10-21 tags: - attack.credential-access - attack.t1003.001 - attack.s0005 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: - \WCE.exe - \WCE64.exe selection_hash: Hashes|contains: - IMPHASH=136F0A8572C058A96436C82E541E4C41 - IMPHASH=589657C64DDE88533186C39F82FA1F50 - IMPHASH=6BFE09EFCB4FFDE061EBDBAFC4DB84CF - IMPHASH=7D490037BF450877E6D0287BDCFF8D2E - IMPHASH=8AB93B061287C79F3088C5BC7E7D97ED - IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F - IMPHASH=BA434A7A729EEC20E136CA4C32D6C740 - IMPHASH=BD1D1547DA13C0FCB6C15E86217D5EB8 - IMPHASH=E96A73C7BF33A464C510EDE582318BF2 condition: 1 of selection_* falsepositives: - Unknown level: critical
Near-miss passage: Sigma rule: Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing. The pattern ". Logsource: zeek / dns. Rule: title: Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network id: 5588576c-5898-4fac-bcdd-7475a60e8f43 related: - id: b07e58cf-cacc-4135-8473-ccb2eba63dd2 type: similar - id: e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c type: similar status: experimental description: 'Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073. ' references: - https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025 - https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-06-20 tags: - attack.collection - attack.credential-access - attack.persistence - attack.privilege-escalation - attack.t1557.001 - attack.t1187 logsource: product: zeek service: dns detection: selection: query|contains|all: - UWhRCA - BAAAA condition: selection falsepositives: - Unknown level: high