Windows credential manager and vault access from unusual process images

Alerts on access to Windows credential/vault files by uncommon processes based on image path and file location.

FreeUnreviewedSigmamediumv1

windows-credential-manager-and-vault-access-from-unusual-process-images-407aecb1

title: Windows credential manager and vault access from unusual process images
id: 71ed4328-452a-44a9-b838-cb8c38594a7f
status: test
description: This rule flags file access to common Windows credential storage locations, including user credential and vault directories, when performed by processes whose image path does not match typical system or Explorer activity. Such access is relevant because credential-stealing tooling and malicious processes often read these stores to extract secrets. It relies on Windows file access telemetry that records the accessing process image path alongside file paths under the credential manager and vault directories.
references:
  - https://hunter2.gitbook.io/darthsidious/privilege-escalation/mimikatz
  - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_access/file_access_win_susp_credential_manager_access.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-11
modified: 2026-07-28
tags:
  - attack.t1003
  - attack.credential-access
logsource:
  category: file_access
  product: windows
  definition: "Requirements: Microsoft-Windows-Kernel-File ETW provider"
detection:
  selection:
    FileName|contains:
      - \AppData\Local\Microsoft\Credentials\
      - \AppData\Roaming\Microsoft\Credentials\
      - \AppData\Local\Microsoft\Vault\
      - \ProgramData\Microsoft\Vault\
  filter_main_system_folders:
    Image|startswith:
      - C:\Program Files\
      - C:\Program Files (x86)\
      - C:\Windows\system32\
      - C:\Windows\SysWOW64\
  filter_main_explorer:
    Image: C:\Windows\explorer.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Legitimate software installed by the users for example in the "AppData" directory may access these files (for any reason).
level: medium
license: DRL-1.1
related:
  - id: 407aecb1-e762-4acf-8c7b-d087bcff3bb6
    type: derived

What it detects

This rule flags file access to common Windows credential storage locations, including user credential and vault directories, when performed by processes whose image path does not match typical system or Explorer activity. Such access is relevant because credential-stealing tooling and malicious processes often read these stores to extract secrets. It relies on Windows file access telemetry that records the accessing process image path alongside file paths under the credential manager and vault directories.

Known false positives

Legitimate software installed by the users for example in the "AppData" directory may access these files (for any reason).

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.