Windows Credential Editor Service Registry Key
This rule detects the creation or modification of a specific registry key associated with Windows Credential Editor (WCE). WCE is a tool used to dump credentials from memory, specifically targeting the Local Security Authority Subsystem Service (LSASS). The rule looks for the string 'Services\WCESERVICE\Start' within the 'TargetObject' field of registry events, indicating the installation or activation of WCE as a service.
Sigma
