Protected Storage Service Access

Title: Protected Storage Service Access
Status: test
Description:Detects access to a protected_storage service over the network. Potential abuse of DPAPI to extract domain backup keys from Domain Controllers
References:
  -https://threathunterplaybook.com/hunts/windows/190620-DomainDPAPIBackupKeyExtraction/notebook.html
Author: Roberto Rodriguez @Cyb3rWard0g
Date: 2019-08-10
modified:2021-11-27
Tags:

• -'attack.lateral-movement'
• -'attack.t1021.002'

Logsource:

• product: windows
• service: security

Detection:
  selection:
    EventID: '5145'
    ShareName|contains: 'IPC'
    RelativeTargetName: 'protected_storage'
  condition:selection
Falsepositives:
  -Unknown
Level: high