
title: WCE wceaux.dll Access
author: Thomas Patzke
date: 2017/06/14
description: Detects wceaux.dll access while WCE pass-the-hash remote command execution
  on source host
detection:
  SELECTION_1:
    EventID: 4656
  SELECTION_2:
    EventID: 4658
  SELECTION_3:
    EventID: 4660
  SELECTION_4:
    EventID: 4663
  SELECTION_5:
    ObjectName: '*\wceaux.dll'
  condition: ((SELECTION_1 or SELECTION_2 or SELECTION_3 or SELECTION_4) and SELECTION_5)
falsepositives:
- Penetration testing
id: 1de68c67-af5c-4097-9c85-fe5578e09e67
level: critical
logsource:
  product: windows
  service: security
references:
- https://www.jpcert.or.jp/english/pub/sr/ir_research.html
- https://jpcertcc.github.io/ToolAnalysisResultSheet
status: experimental
tags:
- attack.credential_access
- attack.t1003
- attack.s0005
ruletype: SIGMA
