Access To Windows DPAPI Master Keys By Uncommon Applications

Title: Access To Windows DPAPI Master Keys By Uncommon Applications
Status: test
Description:Detects file access requests to the the Windows Data Protection API Master keys by an uncommon application. This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::masterkey" function
References:
  -http://blog.harmj0y.net/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/
  -https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-17
modified:2026-07-28
Tags:

• -'attack.credential-access'
• -'attack.t1555.004'

Logsource:

• category: file_access
• product: windows
• definition: Requirements: Microsoft-Windows-Kernel-File ETW provider

Detection:
  selection:
    FileName|contains:
      -'\Microsoft\Protect\S-1-5-18\'
      -'\Microsoft\Protect\S-1-5-21-'

  filter_main_system_folders:
    Image|startswith:
      -'C:\Program Files\'
      -'C:\Program Files (x86)\'
      -'C:\Windows\system32\'
      -'C:\Windows\SysWOW64\'

  filter_main_explorer:
    Image: 'C:\Windows\explorer.exe'
  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Unknown
Level: medium