Detection rules › Sigma
Credentials (protected by DPAPI) dump via network share
Detects scenarios where an attacker attempt to dump DPAPI credentials (Windows Vault, Chrome, RDP, WiFi, Emails, ...) or registry hives via network share via tools like DonPAPI.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1555.004 Credentials from Password Stores: Windows Credential Manager |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 5145 | A network share object was checked to see whether client can be granted desired access. |
Rule body yaml
title: Credentials (protected by DPAPI) dump via network share
description: Detects scenarios where an attacker attempt to dump DPAPI credentials (Windows Vault, Chrome, RDP, WiFi, Emails, ...) or registry hives via network share via tools like DonPAPI.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/EVTX_full_APT_attack_steps
- https://github.com/login-securite/DonPAPI
- https://hackinparis.com/data/slides/2019/talks/HIP2019-Paula_Januszkiewicz-Dpapi_And_Dpapi_Ng_Decrypting_All_Users_Secrets_And_Pfx_Passwords.pdf
- https://www.thehacker.recipes/ad/movement/credentials/dumping/dpapi-protected-secrets
- https://hunter2.gitbook.io/darthsidious/privilege-escalation/mimikatz
- https://book.hacktricks.xyz/windows/windows-local-privilege-escalation/dpapi-extracting-passwords
tags:
- attack.credential_access
- attack.t1555.004
author: mdecrevoisier
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 5145
ShareName: '\\*\C$'
RelativeTargetName|contains:
# WIFI
- '\ProgramData\Microsoft\Wlansvc\Profiles\Interfaces\'
# Registry hives (security, system, sofware)
- '\Windows\System32\config\SECURITY'
- '\Windows\System32\config\SOFTWARE'
- '\Windows\System32\config\SYSTEM'
# Vault
- '\AppData\Local\Microsoft\Vault\'
- '\ProgramData\Microsoft\Vault\'
- '\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Vault\'
# Credentials
- '\AppData\Local\Microsoft\Credentials\'
- '\AppData\Roaming\Microsoft\Credentials\'
- '\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials\'
# DPAPI keys
- '\AppData\Roaming\Microsoft\Protect\'
- '\Windows\System32\Microsoft\Protect\'
condition: selection
falsepositives:
- None
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
EventID: 5145
ShareName: '\\*\C$'
RelativeTargetName|contains:
- '\ProgramData\Microsoft\Wlansvc\Profiles\Interfaces\'
- '\Windows\System32\config\SECURITY'
- '\Windows\System32\config\SOFTWARE'
- '\Windows\System32\config\SYSTEM'
- '\AppData\Local\Microsoft\Vault\'
- '\ProgramData\Microsoft\Vault\'
- '\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Vault\'
- '\AppData\Local\Microsoft\Credentials\'
- '\AppData\Roaming\Microsoft\Credentials\'
- '\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Credentials\'
- '\AppData\Roaming\Microsoft\Protect\'
- '\Windows\System32\Microsoft\Protect\'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
RelativeTargetName | match |
|
ShareName | wildcard |
|