Credentials (protected by DPAPI) dump via network share

Status: experimental
Severity: high
Log source: product windows, service security
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempt to dump DPAPI credentials (Windows Vault, Chrome, RDP, WiFi, Emails, ...) or registry hives via network share via tools like DonPAPI.

Known false positives

None

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1555.004` Credentials from Password Stores: Windows Credential Manager

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 5145: A network share object was checked to see whether client can be granted desired access.

Rule body

title: Credentials (protected by DPAPI) dump via network share
description: Detects scenarios where an attacker attempt to dump DPAPI credentials (Windows Vault, Chrome, RDP, WiFi, Emails, ...) or registry hives via network share via tools like DonPAPI.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/EVTX_full_APT_attack_steps
- https://github.com/login-securite/DonPAPI
- https://hackinparis.com/data/slides/2019/talks/HIP2019-Paula_Januszkiewicz-Dpapi_And_Dpapi_Ng_Decrypting_All_Users_Secrets_And_Pfx_Passwords.pdf
- https://www.thehacker.recipes/ad/movement/credentials/dumping/dpapi-protected-secrets
- https://hunter2.gitbook.io/darthsidious/privilege-escalation/mimikatz
- https://book.hacktricks.xyz/windows/windows-local-privilege-escalation/dpapi-extracting-passwords
tags:
- attack.credential_access
- attack.t1555.004
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5145
    ShareName: '\\*\C$'
    RelativeTargetName|contains:
    # WIFI
    - '\ProgramData\Microsoft\Wlansvc\Profiles\Interfaces\'
    # Registry hives (security, system, sofware)
    - '\Windows\System32\config\SECURITY'
    - '\Windows\System32\config\SOFTWARE'
    - '\Windows\System32\config\SYSTEM'
    # Vault
    - '\AppData\Local\Microsoft\Vault\'
    - '\ProgramData\Microsoft\Vault\'
    - '\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Vault\'
    # Credentials
    - '\AppData\Local\Microsoft\Credentials\'
    - '\AppData\Roaming\Microsoft\Credentials\'
    - '\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials\'
    # DPAPI keys
    - '\AppData\Roaming\Microsoft\Protect\'
    - '\Windows\System32\Microsoft\Protect\'
  condition: selection
falsepositives:
- None
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
  EventID: 5145
  ShareName: '\\*\C$'
  RelativeTargetName|contains:
  - '\ProgramData\Microsoft\Wlansvc\Profiles\Interfaces\'
  - '\Windows\System32\config\SECURITY'
  - '\Windows\System32\config\SOFTWARE'
  - '\Windows\System32\config\SYSTEM'
  - '\AppData\Local\Microsoft\Vault\'
  - '\ProgramData\Microsoft\Vault\'
  - '\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Vault\'
  - '\AppData\Local\Microsoft\Credentials\'
  - '\AppData\Roaming\Microsoft\Credentials\'
  - '\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials\'
  - '\AppData\Roaming\Microsoft\Protect\'
  - '\Windows\System32\Microsoft\Protect\'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`RelativeTargetName`	match	`\AppData\Local\Microsoft\Credentials\` `\AppData\Local\Microsoft\Vault\` `\AppData\Roaming\Microsoft\Credentials\` `\AppData\Roaming\Microsoft\Protect\` `\ProgramData\Microsoft\Vault\` `\ProgramData\Microsoft\Wlansvc\Profiles\Interfaces\` `\Windows\System32\Microsoft\Protect\` `\Windows\System32\config\SECURITY` `\Windows\System32\config\SOFTWARE` `\Windows\System32\config\SYSTEM` `\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials\` `\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Vault\`	`field:"RelativeTargetName" kind:match`
`ShareName`	wildcard	`\\*\C$` corpus 7 (sigma 7)	`field:"ShareName" kind:wildcard value:"\\*\C$"`