HackTool - Windows Credential Editor (WCE) Execution

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•22

Detects the execution of Windows Credential Editor (WCE), a post-exploitation tool used to extract plaintext passwords, hashes, PIN codes, and Kerberos tickets from memory. This tool is commonly employed by threat actors for credential dumping and facilitating lateral movement within compromised networks.