Suspicious Active Directory DPAPI attributes accessed (Mimikatz, DCSync, RiskySPN)

title: Suspicious Active Directory DPAPI attributes accessed (Mimikatz, DCSync, RiskySPN)
name: dpapi_access # Rule Reference
description: Detects scenarios where an attacker attempts to extract sensitive DPAPI information from Active Directory (RiskySPN PowerShell tool, DCSync and Mimikatz may also trigger this rule).
requirements: extended rights auditing enabled (https://www.manageengine.com/products/active-directory-audit/active-directory-auditing-configuration-guide-configure-object-level-auditing-manually.html)
references:
  - https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access/T1555-Credentials%20from%20Password%20Stores
  - https://docs.microsoft.com/en-us/windows/win32/adschema/extended-rights
  - https://github.com/PSGumshoe/PSGumshoe/blob/master/DirectoryService/PrivateFunctions.ps1
  - https://stealthbits.com/blog/detecting-persistence-through-active-directory-extended-rights/
  - https://cqureacademy.com/blog/extracting-roamed-private-keys
  - https://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/
  - https://www.mandiant.com/resources/blog/apt29-windows-credential-roaming
  - https://www.dsinternals.com/en/retrieving-dpapi-backup-keys-from-active-directory/
tags:
  - attack.credential_access
  - attack.t1555.004 # Credentials from Password Stores: Windows Credential Manager
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4662
    Properties|contains:
      - 612cb747-c0e8-4f92-9221-fdd5f15b550d # unixUserPassword
      - 6617e4ac-a2f1-43ab-b60c-11fbd1facf05 # ms-PKI-RoamingTimeStamp / Indicates the time of the last synchronization
      - b3f93023-9239-4f7c-b99c-6745d87adbc2 # ms-PKI-DPAPIMasterKeys / Stores the DPAPI Master Keys. These symmetric keys encrypt the private keys and are themselves encrypted.
      - b7ff5a38-0818-42b0-8110-d3d154c97f24 # ms-PKI-Credential-Roaming-Tokens > see Mandiant link
      - b8dfa744-31dc-4ef1-ac7c-84baf7ef9da7 # ms-PKI-AccountCredentials / Stores certificates, certificate signing requests, private keys and saved passwords.
  filter:
    SubjectUserName|endswith: "$"
  condition: selection and not filter
falsepositives:
  - Active Directory Backup solutions
level: informational

---
title: Suspicious Active Directory DPAPI attributes accessed Count
status: experimental
correlation:
  type: value_count
  rules:
    - dpapi_access # Referenced here
  group-by:
    - Computer
  timespan: 30m
  condition:
    gte: 5
    field: ObjectName
level: high