attack.s0005

HackTool - Windows Credential Editor (WCE) Execution

Nov 25, 2024 · attack.credential-access attack.t1003.001 attack.s0005 ·

Detects the use of Windows Credential Editor (WCE)

Credential Dumping Tools Service Execution - Security

Aug 12, 2024 · attack.credential-access attack.execution attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 attack.t1569.002 attack.s0005 ·

Share on:

Detects well-known credential dumping tools execution via service execution events

Credential Dumping Tools Service Execution - System

Aug 12, 2024 · attack.credential-access attack.execution attack.t1003.001 attack.t1003.002 attack.t1003.004 attack.t1003.005 attack.t1003.006 attack.t1569.002 attack.s0005 ·

Share on:

Detects well-known credential dumping tools execution via service execution events

Password Dumper Remote Thread in LSASS

Aug 12, 2024 · attack.credential-access attack.s0005 attack.t1003.001 ·

Share on:

Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe process as TargetImage. The process in field Process is the malicious program. A single execution can lead to hundreds of events.

WCE wceaux.dll Access

Aug 12, 2024 · attack.credential-access attack.t1003 attack.s0005 ·

Share on:

Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host

HackTool - Windows Credential Editor (WCE) Execution

Credential Dumping Tools Service Execution - Security

Credential Dumping Tools Service Execution - System

Password Dumper Remote Thread in LSASS

WCE wceaux.dll Access

Windows Credential Editor Registry