Windows Credential History File Access by Uncommon Applications
Alerts on CREDHIST file access from unexpected application images, indicating potential credential history theft.
- Product
- windows
- Category
- file_access
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-10-17
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags file access to the Windows Credential History file (ending with \Microsoft\Protect\CREDHIST) when initiated by an application path that is not commonly seen among standard system directories. Credential history data is sensitive, and unusual access patterns can indicate attempts to collect or decrypt credential material. It relies on Windows file access telemetry that includes the accessed filename and the initiating process image path.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Credential History File Access by Uncommon Applications
id: 05d58cfc-5b53-4609-acae-30722d7dbe61
status: test
description: This rule flags file access to the Windows Credential History file (ending with \Microsoft\Protect\CREDHIST) when initiated by an application path that is not commonly seen among standard system directories. Credential history data is sensitive, and unusual access patterns can indicate attempts to collect or decrypt credential material. It relies on Windows file access telemetry that includes the accessed filename and the initiating process image path.
references:
- https://tools.thehacker.recipes/mimikatz/modules/dpapi/credhist
- https://www.passcape.com/windows_password_recovery_dpapi_credhist
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_access/file_access_win_susp_credhist.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-17
modified: 2024-07-29
tags:
- attack.credential-access
- attack.t1555.004
logsource:
category: file_access
product: windows
definition: "Requirements: Microsoft-Windows-Kernel-File ETW provider"
detection:
selection:
FileName|endswith: \Microsoft\Protect\CREDHIST
filter_main_system_folders:
Image|startswith:
- C:\Program Files\
- C:\Program Files (x86)\
- C:\Windows\system32\
- C:\Windows\SysWOW64\
filter_main_explorer:
Image: C:\Windows\explorer.exe
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 7a2a22ea-a203-4cd3-9abf-20eb1c5c6cd2
type: derived