Potential Credential Access via Windows Credential History

[rule]
description = """
Identifies an unusual process accessing Users Windows Credential History File. The CREDHIST file contains previous
password related master key hashes used by Microsoft's DPAPI. Adversaries may acquire credentials from the Windows
Credential Manager.
"""
id = "ce8a6302-7248-457a-8427-3d6bad14e2f0"
license = "Elastic License v2"
name = "Potential Credential Access via Windows Credential History"
os_list = ["windows"]
reference = ["http://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/"]
version = "1.0.30"

query = '''
file where event.action == "open" and
   /* Credentials History */
  file.path : "?:\\Users\\*\\AppData\\*\\Microsoft\\Protect\\CREDHIST" and
  user.id : ("S-1-5-21*", "S-1-12-*") and process.executable : "?:\\*" and
  /* third party programs and noisy native system processes */
  not process.executable :
          ("?:\\Program Files\\*",
           "?:\\Program Files (x86)\\*",
           "?:\\Windows\\System32\\lsass.exe",
           "?:\\Windows\\System32\\svchost.exe",
           "?:\\Windows\\System32\\Robocopy.exe",
           "?:\\Windows\\ccmcache\\*.exe",
           "?:\\Windows\\CCM\\*.exe",
           "?:\\Windows\\explorer.exe",
           "?:\\ProgramData\\Microsoft\\Windows Defender\\*.exe",
           "?:\\Windows\\explorer.exe",
           "?:\\Windows\\System32\\WerFault.exe",
           "?:\\Windows\\SysWOW64\\WerFault.exe",
           "?:\\Windows\\System32\\dllhost.exe",
           "?:\\Windows\\System32\\sdclt.exe",
           "?:\\Windows\\System32\\PickerHost.exe",
           "?:\\Windows\\System32\\MRT.exe",
           "?:\\Windows\\System32\\xcopy.exe",
           "?:\\Users\\*\\AppData\\Local\\Programs\\Git\\usr\\bin\\find.exe",
           "?:\\Users\\*\\git\\usr\\bin\\grep.exe",
           "?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\*\\resources\\app\\node_modules\\@vscode\\ripgrep\\bin\\rg.exe",
           "?:\\Windows\\System32\\Dism.exe") and
  not (process.code_signature.subject_name in ("ForensiT Limited", "Anysphere, Inc.", "Anthropic, PBC", "Open Source Developer, Bryan Berns", "JetBrains s.r.o.", "QUICK HEAL TECHNOLOGIES LIMITED") and process.code_signature.trusted == true)
'''

min_endpoint_version = "8.0.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1555"
name = "Credentials from Password Stores"
reference = "https://attack.mitre.org/techniques/T1555/"
[[threat.technique.subtechnique]]
id = "T1555.004"
name = "Windows Credential Manager"
reference = "https://attack.mitre.org/techniques/T1555/004/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.0.0"