CredUI.DLL Loaded By Uncommon Process

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•19

This rule detects when 'credui.dll' or 'wincredui.dll' is loaded by a process that is not commonly associated with these DLLs. Attackers might load these DLLs to interact with Windows Credential Provider functions like 'CredUIPromptForCredentials' or 'CredUnPackAuthenticationBufferW' to prompt users for credentials or extract them.