Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host
Read the full analysis on IntelFusions