This detection rule identifies activities related to the execution of Windows Credential Editor (WCE), a tool commonly used by attackers to manipulate Windows credentials for unauthorized access to user accounts. WCE can extract and edit stored credentials, making it a key target for threat detection efforts. The rule focuses on specific process creation events in Windows and utilizes both hash matching and command line inspection to detect potential malicious behavior. Specifically, it checks for processes with known IMPHASH values associated with WCE and validates command line execution patterns, particularly looking for those that end with '.exe -S' and are launched from 'services.exe', while excluding entries where the parent process is 'clussvc.exe'. This two-pronged detection strategy minimizes the chances of false positives by specifying known hashing signatures of WCE and distinct command line usage. Given the critical nature of credential access tool detections, this rule supports comprehensive security posture by enabling rapid identification of potential credential theft attempts within Windows environments.