DPAPI Backup Keys And Certificate Export Activity IOC

Status: test
Severity: high
Log source: category file_event, product windows
Author: Nounou Mbeiri, Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects file names with specific patterns seen generated and used by tools such as Mimikatz and DSInternals related to exported or stolen DPAPI backup keys and certificates.

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1552.004` Unsecured Credentials: Private Keys `T1555` Credentials from Password Stores

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 11: FileCreate

Rule body

title: DPAPI Backup Keys And Certificate Export Activity IOC
id: 7892ec59-c5bb-496d-8968-e5d210ca3ac4
status: test
description: |
    Detects file names with specific patterns seen generated and used by tools such as Mimikatz and DSInternals related to exported or stolen DPAPI backup keys and certificates.
references:
    - https://www.dsinternals.com/en/dpapi-backup-key-theft-auditing/
    - https://github.com/MichaelGrafnetter/DSInternals/blob/39ee8a69bbdc1cfd12c9afdd7513b4788c4895d4/Src/DSInternals.Common/Data/DPAPI/DPAPIBackupKey.cs#L28-L32
author: Nounou Mbeiri, Nasreddine Bencherchali (Nextron Systems)
date: 2024-06-26
tags:
    - attack.credential-access
    - attack.t1555
    - attack.t1552.004
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|contains:
            - 'ntds_capi_'
            - 'ntds_legacy_'
            - 'ntds_unknown_'
        TargetFilename|endswith:
            - '.cer'
            - '.key'
            - '.pfx'
            - '.pvk'
    condition: selection
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    TargetFilename|contains:
        - 'ntds_capi_'
        - 'ntds_legacy_'
        - 'ntds_unknown_'
    TargetFilename|endswith:
        - '.cer'
        - '.key'
        - '.pfx'
        - '.pvk'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetFilename`	ends_with	`.cer` corpus 2 (sigma 2) `.key` corpus 2 (sigma 2) `.pfx` corpus 2 (sigma 2) `.pvk`	`field:"TargetFilename" kind:ends_with`
`TargetFilename`	match	`ntds_capi_` `ntds_legacy_` `ntds_unknown_`	`field:"TargetFilename" kind:match`