CredUI.DLL Loaded By Uncommon Process — Detection Rule

Detects loading of "credui.dll" and related DLLs by an uncommon process. Attackers might leverage this DLL for potential use of "CredUIPromptForCredentials" or "CredUnPackAuthenticationBufferW".

Read the full analysis on IntelFusions