WCE wceaux.dll Access

Title: WCE wceaux.dll Access
Status: test
Description:Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host
References:
  -https://www.jpcert.or.jp/english/pub/sr/ir_research.html
  -https://jpcertcc.github.io/ToolAnalysisResultSheet
Author: Thomas Patzke
Date: 2017-06-14
modified:2025-01-30
Tags:

• -'attack.credential-access'
• -'attack.t1003'
• -'attack.s0005'

Logsource:

• product: windows
• service: security

Detection:
  selection:
    EventID:
      -'4656'
      -'4663'

    ObjectName|endswith: '\wceaux.dll'
  condition:selection
Falsepositives:
  -Unknown
Level: critical