DPAPI Backup Keys And Certificate Export Activity IOC

calendar Jun 4, 2025 · attack.credential-access attack.t1555 attack.t1552.004  ·
Share on: linkedin copy

Detects file names with specific patterns seen generated and used by tools such as Mimikatz and DSInternals related to exported or stolen DPAPI backup keys and certificates.

Sigma rule (View on GitHub)

 1title: DPAPI Backup Keys And Certificate Export Activity IOC
 2id: 7892ec59-c5bb-496d-8968-e5d210ca3ac4
 3status: test
 4description: |
 5        Detects file names with specific patterns seen generated and used by tools such as Mimikatz and DSInternals related to exported or stolen DPAPI backup keys and certificates.
 6references:
 7    - https://www.dsinternals.com/en/dpapi-backup-key-theft-auditing/
 8    - https://github.com/MichaelGrafnetter/DSInternals/blob/39ee8a69bbdc1cfd12c9afdd7513b4788c4895d4/Src/DSInternals.Common/Data/DPAPI/DPAPIBackupKey.cs#L28-L32
 9author: Nounou Mbeiri, Nasreddine Bencherchali (Nextron Systems)
10date: 2024-06-26
11tags:
12    - attack.credential-access
13    - attack.t1555
14    - attack.t1552.004
15logsource:
16    product: windows
17    category: file_event
18detection:
19    selection:
20        TargetFilename|contains:
21            - 'ntds_capi_'
22            - 'ntds_legacy_'
23            - 'ntds_unknown_'
24        TargetFilename|endswith:
25            - '.cer'
26            - '.key'
27            - '.pfx'
28            - '.pvk'
29    condition: selection
30falsepositives:
31    - Unlikely
32level: high

References

  • Detecting DPAPI Backup Key Theft

    Introduction The Data Protection API (DPAPI) in Windows is used to encrypt passwords saved by browsers, certificate private keys, and other sensitive data. Domain controllers (DCs) hold backup master keys that can be used to decrypt all such secrets encrypted with DPAPI on domain-joined computers. These backup keys are stored as self-signed certificates in Active Directory (AD) objects of type secret called BCKUPKEY_*: Attackers with sufficient permissions can fetch these backup keys from AD through the Local Security Authority (Domain Policy) Remote Protocol (MS-LSAD / LSARPC) and use them to decrypt any secrets protected by DPAPI on all domain-joined Windows machines. It is therefore important for organizations to be able to detect the theft of DPAPI backup keys from AD by malicious actors. This article describes various ways of discovering this attack technique. Attack Classification MITRE ATT&CK® Tactic Credential Access (TA0006) MITRE ATT&CK® Technique Credentials from Password Stores (T1555) MITRE ATT&CK® Sub-Technique Unsecured Credentials: Private Keys (T1552.004) Tenable® Indicator of Attack DPAPI Domain Backup Key Extraction Microsoft® Defender for Identity Alert Malicious request of Data Protection API master key (alert ID 2020) Detection on Domain Controllers The most reliable way of detecting this attack technique is to monitor domain controllers for suspicious operations. Domain Controller Security Event Logs When a DPAPI backup key is retrieved from a domain controller (DC) through the MS-LSAD protocol, an undocumented event with the following properties is generated on that DC: Log Name Security Event ID 4662 Keywords Audit Success Task Category Other Object Access Events Object Server LSA Object Type SecretObject Accesses Query secret value Object Name Policy\Secrets\G$BCKUPKEY_*


    Read More

  • DSInternals/Src/DSInternals.Common/Data/DPAPI/DPAPIBackupKey.cs at 39ee8a69bbdc1cfd12c9afdd7513b4788c4895d4 · MichaelGrafnetter/DSInternals

    Directory Services Internals (DSInternals) PowerShell Module and Framework - MichaelGrafnetter/DSInternals


    Read More

Related rules

to-top