Detects file access requests to the Windows Credential History File by an uncommon application. This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::credhist" function

Read More

Detects file access requests to the the Windows Data Protection API Master keys by an uncommon application. This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::masterkey" function

Read More

Detects the invocation of the Stored User Names and Passwords dialogue (Key Manager)

Read More

List credentials currently stored in Windows Credential Manager via the native Windows utility vaultcmd.exe

Read More