Detection rules › Sigma
Suspicious Active Directory DPAPI attributes accessed (Mimikatz, DCSync, RiskySPN)
Detects scenarios where an attacker attempts to extract sensitive DPAPI information from Active Directory (RiskySPN PowerShell tool, DCSync and Mimikatz may also trigger this rule).
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1555.004 Credentials from Password Stores: Windows Credential Manager |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4662 | An operation was performed on an object. |
Rule body yaml
title: Suspicious Active Directory DPAPI attributes accessed (Mimikatz, DCSync, RiskySPN)
name: dpapi_access # Rule Reference
description: Detects scenarios where an attacker attempts to extract sensitive DPAPI information from Active Directory (RiskySPN PowerShell tool, DCSync and Mimikatz may also trigger this rule).
requirements: extended rights auditing enabled (https://www.manageengine.com/products/active-directory-audit/active-directory-auditing-configuration-guide-configure-object-level-auditing-manually.html)
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access/T1555-Credentials%20from%20Password%20Stores
- https://docs.microsoft.com/en-us/windows/win32/adschema/extended-rights
- https://github.com/PSGumshoe/PSGumshoe/blob/master/DirectoryService/PrivateFunctions.ps1
- https://stealthbits.com/blog/detecting-persistence-through-active-directory-extended-rights/
- https://cqureacademy.com/blog/extracting-roamed-private-keys
- https://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/
- https://www.mandiant.com/resources/blog/apt29-windows-credential-roaming
- https://www.dsinternals.com/en/retrieving-dpapi-backup-keys-from-active-directory/
tags:
- attack.credential_access
- attack.t1555.004 # Credentials from Password Stores: Windows Credential Manager
author: mdecrevoisier
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 4662
Properties|contains:
- 612cb747-c0e8-4f92-9221-fdd5f15b550d # unixUserPassword
- 6617e4ac-a2f1-43ab-b60c-11fbd1facf05 # ms-PKI-RoamingTimeStamp / Indicates the time of the last synchronization
- b3f93023-9239-4f7c-b99c-6745d87adbc2 # ms-PKI-DPAPIMasterKeys / Stores the DPAPI Master Keys. These symmetric keys encrypt the private keys and are themselves encrypted.
- b7ff5a38-0818-42b0-8110-d3d154c97f24 # ms-PKI-Credential-Roaming-Tokens > see Mandiant link
- b8dfa744-31dc-4ef1-ac7c-84baf7ef9da7 # ms-PKI-AccountCredentials / Stores certificates, certificate signing requests, private keys and saved passwords.
filter:
SubjectUserName|endswith: "$"
condition: selection and not filter
falsepositives:
- Active Directory Backup solutions
level: informational
---
title: Suspicious Active Directory DPAPI attributes accessed Count
status: experimental
correlation:
type: value_count
rules:
- dpapi_access # Referenced here
group-by:
- Computer
timespan: 30m
condition:
gte: 5
field: ObjectName
level: high
Stages and Predicates
Stage 0: condition
selection and not filterStage 1: selection
selection:
EventID: 4662
Properties|contains:
- 612cb747-c0e8-4f92-9221-fdd5f15b550d
- 6617e4ac-a2f1-43ab-b60c-11fbd1facf05
- b3f93023-9239-4f7c-b99c-6745d87adbc2
- b7ff5a38-0818-42b0-8110-d3d154c97f24
- b8dfa744-31dc-4ef1-ac7c-84baf7ef9da7
Stage 2: not filter
filter:
SubjectUserName|endswith: "$"
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
SubjectUserName | ends_with | $ |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Properties | match |
|