huntrule

Windows Security Event 4692 Detecting DPAPI Domain Master Key Backup Attempt

Flags Windows Event ID 4692 indicating an attempt to back up the DPAPI domain master key.

FreeReviewedSigma · Medium · v2
Product
windows
Service
security
Author
Roberto Rodriguez @Cyb3rWard0g (SigmaHQ), DRL 1.1
Published
2019-08-10
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Cred Access

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies attempts to back up the DPAPI Domain Master Key using Windows Security auditing. Attackers may use DPAPI key material access to enable decryption of protected credentials or sensitive data across a domain. It relies on Windows Security Event ID 4692 telemetry emitted by the source system generating the event rather than the Domain Controller.

Reporting behind it

Related detections9 linkedT1003.004 — drag to rearrange
Windows PUA: MemProcFS memory dump mounting via -device
Zeek SMB Files: Impacket SecretDump Access to ADMIN$ and System32 .tmp Droppers
Windows Credential Dump Tool Artifacts Written to Disk via File Events
Windows Named Pipe Creation for Known Credential Dumping Tool Pipe Names
Windows Process Creation: Detect Mimikatz Tool and Module Command-Line Usage
Windows reg.exe Registry Hive Dumping for SAM, SYSTEM, and SECURITY
Windows Security Event 4662 Detects DPAPI Domain Backup Key Extraction from Domain Controllers
Windows System Service Execution of Credential Dumping Tools (Service Control Manager Event 7045)
Windows Security EID 4697 Service Execution of Credential Dumping Tools
Windows Security Event 4692 Detecting DPAPI Domain Master Key Backup Attempt
Pivot detection · T1003.004 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.