Title:
DPAPI Domain Master Key Backup Attempt
Status:
test
Description:Detects anyone attempting a backup for the DPAPI Master Key. This events gets generated at the source and not the Domain Controller.
References:
-https://threathunterplaybook.com/hunts/windows/190620-DomainDPAPIBackupKeyExtraction/notebook.html
Author: Roberto Rodriguez @Cyb3rWard0g
Date: 2019-08-10
modified:2023-03-15
Tags:
- -'attack.credential-access'
- -'attack.t1003.004'
Logsource:
- product: windows
- service: security
Detection:
selection:
EventID:
'4692'
condition:
selection
Falsepositives:
-If a computer is a member of a domain, DPAPI has a backup mechanism to allow unprotection of the data. Which will trigger this event.
Level:
medium
