huntrule

Windows Credential History File Access by Uncommon Applications

Alerts on CREDHIST file access from unexpected application images, indicating potential credential history theft.

FreeReviewedSigma · Medium · v2
Product
windows
Category
file_access
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-10-17
Updated
2026-07-31
AnalysisDetection
title: Windows Credential History File Access by Uncommon Applications
id: 05d58cfc-5b53-4609-acae-30722d7dbe61
status: test
description: This rule flags file access to the Windows Credential History file (ending with \Microsoft\Protect\CREDHIST) when initiated by an application path that is not commonly seen among standard system directories. Credential history data is sensitive, and unusual access patterns can indicate attempts to collect or decrypt credential material. It relies on Windows file access telemetry that includes the accessed filename and the initiating process image path.
references:
  - https://tools.thehacker.recipes/mimikatz/modules/dpapi/credhist
  - https://www.passcape.com/windows_password_recovery_dpapi_credhist
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_access/file_access_win_susp_credhist.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-17
modified: 2024-07-29
tags:
  - attack.credential-access
  - attack.t1555.004
logsource:
  category: file_access
  product: windows
  definition: "Requirements: Microsoft-Windows-Kernel-File ETW provider"
detection:
  selection:
    FileName|endswith: \Microsoft\Protect\CREDHIST
  filter_main_system_folders:
    Image|startswith:
      - C:\Program Files\
      - C:\Program Files (x86)\
      - C:\Windows\system32\
      - C:\Windows\SysWOW64\
  filter_main_explorer:
    Image: C:\Windows\explorer.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 7a2a22ea-a203-4cd3-9abf-20eb1c5c6cd2
    type: derived