{"id":"1de68c67-af5c-4097-9c85-fe5578e09e67","title":"WCE wceaux.dll Access","description":"Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host","author":"Thomas Patzke","status":"test","level":"critical","date":"2017-06-14","modified":"2025-01-30","tags":["attack.credential-access","attack.t1003","attack.s0005"],"technique_ids":["T1003"],"logsource":{"product":"windows","service":"security"},"falsepositives":["Unknown"],"references":["https://www.jpcert.or.jp/english/pub/sr/ir_research.html","https://jpcertcc.github.io/ToolAnalysisResultSheet"],"source_path":"rules/windows/builtin/security/win_security_mal_wceaux_dll.yml","source_sha256":"2327964b227ba200b16f819e13e33eba999ea709e1b1d6801223a143f6fb31a6","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_mal_wceaux_dll.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: WCE wceaux.dll Access\nid: 1de68c67-af5c-4097-9c85-fe5578e09e67\nstatus: test\ndescription: Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host\nreferences:\n    - https://www.jpcert.or.jp/english/pub/sr/ir_research.html\n    - https://jpcertcc.github.io/ToolAnalysisResultSheet\nauthor: Thomas Patzke\ndate: 2017-06-14\nmodified: 2025-01-30\ntags:\n    - attack.credential-access\n    - attack.t1003\n    - attack.s0005\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        EventID:\n            - 4656\n            - 4663\n        ObjectName|endswith: '\\wceaux.dll'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: critical\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003","id":"T1003","name":"OS Credential Dumping","page":"techniques/enterprise/T1003/"}],"data_path":"data/detection-rules/1de68c67-af5c-4097-9c85-fe5578e09e67.json","kind":"sigma"}