Windows Credential History File Access by Uncommon Image Paths

title: Windows Credential History File Access by Uncommon Image Paths
id: 05d58cfc-5b53-4609-acae-30722d7dbe61
status: test
description: This rule flags file access to the Windows Credential History file (ending with \Microsoft\Protect\CREDHIST) when performed by applications whose image paths are not among common system or Explorer locations. Attackers can use this file as part of credential theft workflows, so unexpected access may indicate malicious credential access attempts. It relies on Windows file access telemetry that includes the accessed file name and the originating process image path.
references:
  - https://tools.thehacker.recipes/mimikatz/modules/dpapi/credhist
  - https://www.passcape.com/windows_password_recovery_dpapi_credhist
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_access/file_access_win_susp_credhist.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-17
modified: 2024-07-29
tags:
  - attack.credential-access
  - attack.t1555.004
logsource:
  category: file_access
  product: windows
  definition: "Requirements: Microsoft-Windows-Kernel-File ETW provider"
detection:
  selection:
    FileName|endswith: \Microsoft\Protect\CREDHIST
  filter_main_system_folders:
    Image|startswith:
      - C:\Program Files\
      - C:\Program Files (x86)\
      - C:\Windows\system32\
      - C:\Windows\SysWOW64\
  filter_main_explorer:
    Image: C:\Windows\explorer.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 7a2a22ea-a203-4cd3-9abf-20eb1c5c6cd2
    type: derived