file_access

Access To Crypto Currency Wallets By Uncommon Applications

Jun 2, 2025 · attack.t1003 attack.credential-access ·

Detects file access requests to crypto currency files by uncommon processes. Could indicate potential attempt of crypto currency wallet stealing.

Access To Potentially Sensitive Sysvol Files By Uncommon Applications

Jun 2, 2025 · attack.credential-access attack.t1552.006 ·

Share on:

Detects file access requests to potentially sensitive files hosted on the Windows Sysvol share.

Access To Windows Credential History File By Uncommon Applications

Jun 2, 2025 · attack.credential-access attack.t1555.004 ·

Share on:

Detects file access requests to the Windows Credential History File by an uncommon application. This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::credhist" function

Access To Windows DPAPI Master Keys By Uncommon Applications

Jun 2, 2025 · attack.credential-access attack.t1555.004 ·

Share on:

Detects file access requests to the the Windows Data Protection API Master keys by an uncommon application. This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::masterkey" function

Credential Manager Access By Uncommon Applications

Jun 2, 2025 · attack.t1003 attack.credential-access ·

Share on:

Detects suspicious processes based on name and location that access the windows credential manager and vault. Which can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::cred" function

Microsoft Teams Sensitive File Access By Uncommon Applications

Jun 2, 2025 · attack.credential-access attack.t1528 ·

Share on:

Detects file access attempts to sensitive Microsoft teams files (leveldb, cookies) by an uncommon process.

Suspicious File Access to Browser Credential Storage

May 26, 2025 · attack.credential-access attack.t1555.003 attack.discovery attack.t1217 ·

Share on:

Detects file access to browser credential storage paths by non-browser processes, which may indicate credential access attempts. Adversaries may attempt to access browser credential storage to extract sensitive information such as usernames and passwords or cookies. This behavior is often commonly observed in credential stealing malware.