Access To Windows Credential History File By Uncommon Application

calendar Dec 21, 2023 · attack.credential_access attack.t1555.004  ·
Share on: linkedin copy

Detects file access requests to the Windows Credential History File by an uncommon application. This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::credhist" function

Sigma rule (View on GitHub)

 1title: Access To Windows Credential History File By Uncommon Application
 2id: 7a2a22ea-a203-4cd3-9abf-20eb1c5c6cd2
 3status: experimental
 4description: |
 5    Detects file access requests to the Windows Credential History File by an uncommon application.
 6    This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::credhist" function    
 7references:
 8    - https://tools.thehacker.recipes/mimikatz/modules/dpapi/credhist
 9    - https://www.passcape.com/windows_password_recovery_dpapi_credhist
10author: Nasreddine Bencherchali (Nextron Systems)
11date: 2022/10/17
12modified: 2023/12/18
13tags:
14    - attack.credential_access
15    - attack.t1555.004
16logsource:
17    category: file_access
18    product: windows
19    definition: 'Requirements: Microsoft-Windows-Kernel-File ETW provider'
20detection:
21    selection:
22        FileName|endswith: '\Microsoft\Protect\CREDHIST'
23    filter_main_system_folders:
24        Image|contains:
25            - ':\Program Files\'
26            - ':\Program Files (x86)\'
27            - ':\Windows\system32\'
28            - ':\Windows\SysWOW64\'
29    filter_main_explorer:
30        Image|endswith: ':\Windows\explorer.exe'
31    condition: selection and not 1 of filter_main_*
32falsepositives:
33    - Unknown
34# Increase level after false positives filters are good enough
35level: medium

References

Related rules

to-top