Sigma rule: CredUI.DLL Loaded By Uncommon Process

Rule

Title

CredUI.DLL Loaded By Uncommon Process

Status

test

Level

medium

Author

Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)

Date

2020-10-20

Modified

2026-06-29

File

rules/windows/image_load/image_load_dll_credui_uncommon_process_load.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects loading of "credui.dll" and related DLLs by an uncommon process. Attackers might leverage this DLL for potential use of "CredUIPromptForCredentials" or "CredUnPackAuthenticationBufferW".

Log source

product

windows

category

image_load

Detection

selection:
    - ImageLoaded|endswith:
          - '\credui.dll'
          - '\wincredui.dll'
    - OriginalFileName:
          - 'credui.dll'
          - 'wincredui.dll'
filter_main_generic:
    Image|startswith:
        - 'C:\Program Files (x86)\'
        - 'C:\Program Files\'
        - 'C:\Windows\System32\'
        - 'C:\Windows\SysWOW64\'
        - 'C:\Windows\SystemApps\'
filter_main_full:
    Image:
        - 'C:\Windows\explorer.exe'
        - 'C:\Windows\ImmersiveControlPanel\SystemSettings.exe'
        - 'C:\Windows\regedit.exe' # This FP is triggered for example when choosing the "Connect Network Registry" from the menu
filter_optional_opera:
    Image|endswith: '\opera_autoupdate.exe'
filter_optional_process_explorer:
    Image|endswith:
        - '\procexp64.exe'
        - '\procexp64a.exe'
        - '\procexp.exe'
filter_optional_teams:
    Image|startswith: 'C:\Users\'
    Image|contains: '\AppData\Local\Microsoft\Teams\'
    Image|endswith: '\Teams.exe'
filter_optional_onedrive:
    Image|startswith: 'C:\Users\'
    Image|contains: '\AppData\Local\Microsoft\OneDrive\'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Other legitimate processes loading those DLLs in your environment.

Tags

• attack.credential-access
• attack.collection
• attack.t1056.002

MITRE ATT&CK ids this rule names

• T1056.002

References

• https://securitydatasets.com/notebooks/atomic/windows/credential_access/SDWIN-201020013208.html
• https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.002/T1056.002.md#atomic-test-2---powershell---prompt-user-for-password
• https://learn.microsoft.com/en-us/windows/win32/api/wincred/nf-wincred-creduipromptforcredentialsa
• https://github.com/S12cybersecurity/RDPCredentialStealer

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/image_load/image_load_dll_credui_uncommon_process_load.yml