Windows Credential Editor Registry — Detection Rule

Detects the use of Windows Credential Editor (WCE)

Read the full analysis on IntelFusions