DPAPI Domain Backup Key Extraction

Title: DPAPI Domain Backup Key Extraction
Status: test
Description:Detects tools extracting LSA secret DPAPI domain backup key from Domain Controllers
References:
  -https://threathunterplaybook.com/hunts/windows/190620-DomainDPAPIBackupKeyExtraction/notebook.html
Author: Roberto Rodriguez @Cyb3rWard0g
Date: 2019-06-20
modified:2022-02-24
Tags:

• -'attack.credential-access'
• -'attack.t1003.004'

Logsource:

• product: windows
• service: security

Detection:
  selection:
    EventID: '4662'
    ObjectType: 'SecretObject'
    AccessMask: '0x2'
    ObjectName|contains: 'BCKUPKEY'
  condition:selection
Falsepositives:
  -Unknown
Level: high