Windows Credential Editor Registry

Title: Windows Credential Editor Registry
Status: test
Description:Detects the use of Windows Credential Editor (WCE)
References:
  -https://www.ampliasecurity.com/research/windows-credentials-editor/
Author: Florian Roth (Nextron Systems)
Date: 2019-12-31
modified:2021-11-27
Tags:

• -'attack.credential-access'
• -'attack.t1003.001'
• -'attack.s0005'

Logsource:

• category: registry_event
• product: windows

Detection:
  selection:
    TargetObject|contains: 'Services\WCESERVICE\Start'
  condition:selection
Falsepositives:
  -Unknown
Level: critical