Windows File Creation of DPAPI Backup Key and Certificate Export Files

title: Windows File Creation of DPAPI Backup Key and Certificate Export Files
id: e3a028db-f1b2-4609-825b-507d2ea26e5f
status: test
description: This rule matches file names on Windows that contain DPAPI-related backup key and certificate naming patterns and end with certificate/key file extensions. Attackers can use exported DPAPI backup keys and certificates to facilitate credential access by decrypting protected secrets outside normal user context. The detection relies on file event telemetry containing a target filename with the specified substrings and extensions.
references:
  - https://www.dsinternals.com/en/dpapi-backup-key-theft-auditing/
  - https://github.com/MichaelGrafnetter/DSInternals/blob/39ee8a69bbdc1cfd12c9afdd7513b4788c4895d4/Src/DSInternals.Common/Data/DPAPI/DPAPIBackupKey.cs#L28-L32
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_dpapi_backup_and_cert_export_ioc.yml
author: Nounou Mbeiri, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-06-26
tags:
  - attack.credential-access
  - attack.t1555
  - attack.t1552.004
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|contains:
      - ntds_capi_
      - ntds_legacy_
      - ntds_unknown_
    TargetFilename|endswith:
      - .cer
      - .key
      - .pfx
      - .pvk
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 7892ec59-c5bb-496d-8968-e5d210ca3ac4
    type: derived