Windows Credential Manager Dump Tool Delivered

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects the delivery of a Windows Credential Manager dump tool over HTTP. It specifically looks for the case-insensitive string "CredEnumerate" within the file data of an HTTP response flowing to the client. This string is indicative of tools designed to interact with or dump credentials from the Windows Credential Manager.