Windows Security Events: WCE wceaux.dll File Access

Identifies Windows Security event activity involving access to the wceaux.dll library file.

FreeUnreviewedSigmacriticalv1

windows-security-events-wce-wceaux-dll-file-access-1de68c67

title: "Windows Security Events: WCE wceaux.dll File Access"
id: ab2fcba1-29c5-4865-94c9-a8c8fe4f7038
status: test
description: This rule flags access to wceaux.dll observed in Windows Security audit events (4656 and 4663). Attackers may use this module during remote command execution scenarios to support credential abuse, so file access to a specific DLL can be a useful behavioral indicator. Telemetry relies on object access auditing that records the target filename and related security event IDs.
references:
  - https://www.jpcert.or.jp/english/pub/sr/ir_research.html
  - https://jpcertcc.github.io/ToolAnalysisResultSheet
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_mal_wceaux_dll.yml
author: Thomas Patzke, Huntrule Team
date: 2017-06-14
modified: 2025-01-30
tags:
  - attack.credential-access
  - attack.t1003
  - attack.s0005
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 4656
      - 4663
    ObjectName|endswith: \wceaux.dll
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 1de68c67-af5c-4097-9c85-fe5578e09e67
    type: derived

What it detects

This rule flags access to wceaux.dll observed in Windows Security audit events (4656 and 4663). Attackers may use this module during remote command execution scenarios to support credential abuse, so file access to a specific DLL can be a useful behavioral indicator. Telemetry relies on object access auditing that records the target filename and related security event IDs.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.