huntrule

Windows Process Creation Detecting WCE.exe / WCE64.exe Credential Editor Execution

Flags execution of Windows Credential Editor (WCE.exe/WCE64.exe) using image name endings and known imphash values.

FreeUnreviewedSigmacriticalv1
title: Windows Process Creation Detecting WCE.exe / WCE64.exe Credential Editor Execution
id: 25d5a140-0e8f-4054-9cd5-18b3f9567e71
status: test
description: This rule identifies process creation events where the executable name ends with WCE.exe or WCE64.exe, matching Windows Credential Editor. Credential Editor is commonly abused to extract sensitive authentication material such as plaintext credentials and ticket data from a compromised system. The detection relies on process start telemetry, specifically the process image path and executable hashes (imphash values) to match known binaries.
references:
  - https://www.ampliasecurity.com/research/windows-credentials-editor/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_wce.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-12-31
modified: 2025-10-21
tags:
  - attack.credential-access
  - attack.t1003.001
  - attack.s0005
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - \WCE.exe
      - \WCE64.exe
  selection_hash:
    Hashes|contains:
      - IMPHASH=136F0A8572C058A96436C82E541E4C41
      - IMPHASH=589657C64DDE88533186C39F82FA1F50
      - IMPHASH=6BFE09EFCB4FFDE061EBDBAFC4DB84CF
      - IMPHASH=7D490037BF450877E6D0287BDCFF8D2E
      - IMPHASH=8AB93B061287C79F3088C5BC7E7D97ED
      - IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F
      - IMPHASH=BA434A7A729EEC20E136CA4C32D6C740
      - IMPHASH=BD1D1547DA13C0FCB6C15E86217D5EB8
      - IMPHASH=E96A73C7BF33A464C510EDE582318BF2
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 7aa7009a-28b9-4344-8c1f-159489a390df
    type: derived

What it detects

This rule identifies process creation events where the executable name ends with WCE.exe or WCE64.exe, matching Windows Credential Editor. Credential Editor is commonly abused to extract sensitive authentication material such as plaintext credentials and ticket data from a compromised system. The detection relies on process start telemetry, specifically the process image path and executable hashes (imphash values) to match known binaries.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.