Windows File Access to DPAPI Master Keys by Uncommon Applications

title: Windows File Access to DPAPI Master Keys by Uncommon Applications
id: c995bc04-a659-49c9-b1d8-a2f824cef5d1
status: test
description: This rule flags file access attempts to Windows DPAPI master key locations when the accessing application is not one of the common system or shell processes. Attackers may use DPAPI master keys to enable credential material theft and decryption. It relies on Windows file access telemetry that records the target file path (DPAPI Protect subfolders) and the Image initiating the access.
references:
  - http://blog.harmj0y.net/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/
  - https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_access/file_access_win_susp_dpapi_master_key_access.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-17
modified: 2026-07-28
tags:
  - attack.credential-access
  - attack.t1555.004
logsource:
  category: file_access
  product: windows
  definition: "Requirements: Microsoft-Windows-Kernel-File ETW provider"
detection:
  selection:
    FileName|contains:
      - \Microsoft\Protect\S-1-5-18\
      - \Microsoft\Protect\S-1-5-21-
  filter_main_system_folders:
    Image|startswith:
      - C:\Program Files\
      - C:\Program Files (x86)\
      - C:\Windows\system32\
      - C:\Windows\SysWOW64\
  filter_main_explorer:
    Image: C:\Windows\explorer.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 46612ae6-86be-4802-bc07-39b59feb1309
    type: derived