Detection of Credential Theft via Unauthorized Loading of CredUI DLLs

Adversaries, including those deploying Brute Ratel C4, APT37 Rustonotto, and FadeStealer malware, frequently abuse the Windows Credential User Interface modules (credui.dll and wincredui.dll). By forcing a process to load these modules, attackers can trigger legitimate-looking credential prompts to harvest user passwords and sensitive information. This technique is often used as a precursor to credential theft and lateral movement within compromised environments. Defenders can identify this behavior by monitoring for processes that load these specific DLLs from paths outside of standard system directories like System32 or SysWOW64. This detection logic is critical for identifying malicious code injection or masquerading, as legitimate Windows processes typically load these libraries from well-defined, trusted locations.

Impact

Successful exploitation of this technique allows attackers to capture cleartext credentials or hashed tokens, facilitating privilege escalation and persistence. Observed usage by threat actors such as APT37 indicates that this credential harvesting capability is a standard component of their post-exploitation toolkits, enabling further unauthorized access to target networks.

Recommendation

Deploy detection for unauthorized loading of Credential UI libraries and investigate any alerts generated by processes originating outside standard Windows directories.

• Implement Sysmon Event ID 7 to capture module load events across all Windows endpoints.
• Deploy the Sigma rule provided in this brief to detect the loading of credui.dll or wincredui.dll by non-standard processes.
• Establish a process baseline for applications that legitimately require Credential UI functionality to reduce false positives.
• Review documentation for MITRE ATT&CK T1056.002 to identify related patterns in existing security logs.