Windows Credential Editor (WCE) wceaux.dll Access
This rule detects access to the 'wceaux.dll' file, which is associated with the Windows Credential Editor (WCE) tool. This activity is indicative of an attempt to perform pass-the-hash remote command execution, often used for credential dumping and lateral movement. The rule specifically looks for Security Event IDs 4656 (A handle to an object was requested) or 4663 (An attempt was made to access an object) where the accessed object's name ends with '\wceaux.dll'.
Sigma
