SigmaHQ/rules/windows/builtin/win_mal_wceaux_dll.yml

title: WCE wceaux.dll Access
id: 1de68c67-af5c-4097-9c85-fe5578e09e67
status: experimental
description: Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host
author: Thomas Patzke
date: 2017/06/14
references:
    - https://www.jpcert.or.jp/english/pub/sr/ir_research.html
    - https://jpcertcc.github.io/ToolAnalysisResultSheet
tags:
    - attack.credential_access
    - attack.t1003
    - attack.s0005
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID:
            - 4656
            - 4658
            - 4660
            - 4663
        ObjectName|endswith: '\wceaux.dll'
    condition: selection
falsepositives:
    - Penetration testing
level: critical
Massive Title Cleanup 2018-01-27 09:57:30 +00:00			`title: WCE wceaux.dll Access`
Added UUIDs to rules 2019-11-12 22:12:27 +00:00			`id: 1de68c67-af5c-4097-9c85-fe5578e09e67`
Access to wceaux.dll while WCE pass-the-hash login on source host 2017-06-14 13:59:45 +00:00			`status: experimental`
			`description: Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host`
			`author: Thomas Patzke`
fix: fixed missing date fields in remaining files 2020-01-30 15:07:37 +00:00			`date: 2017/06/14`
Change All "str" references to be "list"to mach schema update 2018-01-27 23:24:16 +00:00			`references:`
			`- https://www.jpcert.or.jp/english/pub/sr/ir_research.html`
JPCERT rules * Addition of ntdsutil.exe rule * Added new link to existing rules 2018-03-07 23:10:19 +00:00			`- https://jpcertcc.github.io/ToolAnalysisResultSheet`
Add tags to windows builtin rules 2018-07-24 05:50:32 +00:00			`tags:`
			`- attack.credential_access`
			`- attack.t1003`
			`- attack.s0005`
Access to wceaux.dll while WCE pass-the-hash login on source host 2017-06-14 13:59:45 +00:00			`logsource:`
			`product: windows`
			`service: security`
			`detection:`
			`selection:`
			`EventID:`
			`- 4656`
			`- 4658`
			`- 4660`
			`- 4663`
Update win_mal_wceaux_dll.yml 2020-10-15 18:41:13 +00:00			`ObjectName\|endswith: '\wceaux.dll'`
Access to wceaux.dll while WCE pass-the-hash login on source host 2017-06-14 13:59:45 +00:00			`condition: selection`
fix: fixed missing date fields in remaining files 2020-01-30 15:07:37 +00:00			`falsepositives:`
Access to wceaux.dll while WCE pass-the-hash login on source host 2017-06-14 13:59:45 +00:00			`- Penetration testing`
			`level: critical`