DPAPI Backup Keys And Certificate Export Activity IOC
Detects file names with specific patterns seen generated and used by tools such as Mimikatz and DSInternals related to exported or stolen DPAPI backup keys and certificates.
Sigma rule (View on GitHub)
1title: DPAPI Backup Keys And Certificate Export Activity IOC
2id: 7892ec59-c5bb-496d-8968-e5d210ca3ac4
3status: experimental
4description: |
5 Detects file names with specific patterns seen generated and used by tools such as Mimikatz and DSInternals related to exported or stolen DPAPI backup keys and certificates.
6references:
7 - https://www.dsinternals.com/en/dpapi-backup-key-theft-auditing/
8 - https://github.com/MichaelGrafnetter/DSInternals/blob/39ee8a69bbdc1cfd12c9afdd7513b4788c4895d4/Src/DSInternals.Common/Data/DPAPI/DPAPIBackupKey.cs#L28-L32
9author: Nounou Mbeiri, Nasreddine Bencherchali (Nextron Systems)
10date: 2024-06-26
11tags:
12 - attack.t1555
13 - attack.t1552.004
14logsource:
15 product: windows
16 category: file_event
17detection:
18 selection:
19 TargetFilename|contains:
20 - 'ntds_capi_'
21 - 'ntds_legacy_'
22 - 'ntds_unknown_'
23 TargetFilename|endswith:
24 - '.cer'
25 - '.key'
26 - '.pfx'
27 - '.pvk'
28 condition: selection
29falsepositives:
30 - Unlikely
31level: high
References
Related rules
- Certificate Exported Via PowerShell
- Certificate Exported Via PowerShell - ScriptBlock
- Cisco Crypto Commands
- Dump Credentials from Windows Credential Manager With PowerShell
- Enumerate Credentials from Windows Credential Manager With PowerShell