CredUI.DLL Loaded By Uncommon Process

{
  "image_load": {
    "EventID": 7,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection": [
    {
      "ImageLoaded
| endswith": [
        "\\credui.dll",
        "\\wincredui.dll"
      ]
    },
    {
      "OriginalFileName": [
        "credui.dll",
        "wincredui.dll"
      ]
    }
  ],
  "filter_main_generic": {
    "Image
| startswith": [
      "C:\\Program Files (x86)\\",
      "C:\\Program Files\\",
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SysWOW64\\",
      "C:\\Windows\\SystemApps\\"
    ]
  },
  "filter_main_full": {
    "Image": [
      "C:\\Windows\\explorer.exe",
      "C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe",
      "C:\\Windows\\regedit.exe"
    ]
  },
  "filter_optional_opera": {
    "Image
| endswith": "\\opera_autoupdate.exe"
  },
  "filter_optional_process_explorer": {
    "Image
| endswith": [
      "\\procexp64.exe",
      "\\procexp64a.exe",
      "\\procexp.exe"
    ]
  },
  "filter_optional_teams": {
    "Image
| startswith": "C:\\Users\\",
    "Image
| contains": "\\AppData\\Local\\Microsoft\\Teams\\",
    "Image
| endswith": "\\Teams.exe"
  },
  "filter_optional_onedrive": {
    "Image
| startswith": "C:\\Users\\",
    "Image
| contains": "\\AppData\\Local\\Microsoft\\OneDrive\\"
  },
  "condition": "image_load and (selection and not 1 of filter_main_* and not 1 of filter_optional_*)"
}

False Positives

• ⚠ Other legitimate processes loading those DLLs in your environment.