Windows Security: DPAPI Domain Master Key Backup Attempt (Event ID 4692)

Flags Windows Event ID 4692 indicating an attempt to back up the DPAPI domain master key.

FreeUnreviewedSigmamediumv1

windows-security-dpapi-domain-master-key-backup-attempt-event-id-4692-39a94fd1

title: "Windows Security: DPAPI Domain Master Key Backup Attempt (Event ID 4692)"
id: 72faa890-fdd1-4b59-b01a-cd5d808c7932
status: test
description: This rule identifies Windows Security events where a DPAPI domain master key backup is attempted, using Event ID 4692 from the originating host. Attackers can use DPAPI key backup functionality to access or unprotect protected credentials, making this activity important to monitor. The detection relies on security log telemetry that records the 4692 event at the source system rather than only on the Domain Controller.
references:
  - https://threathunterplaybook.com/hunts/windows/190620-DomainDPAPIBackupKeyExtraction/notebook.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_dpapi_domain_masterkey_backup_attempt.yml
author: Roberto Rodriguez @Cyb3rWard0g, Huntrule Team
date: 2019-08-10
modified: 2023-03-15
tags:
  - attack.credential-access
  - attack.t1003.004
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4692
  condition: selection
falsepositives:
  - If a computer is a member of a domain, DPAPI has a backup mechanism to allow unprotection of the data. Which will trigger this event.
level: medium
license: DRL-1.1
related:
  - id: 39a94fd1-8c9a-4ff6-bf22-c058762f8014
    type: derived

What it detects

This rule identifies Windows Security events where a DPAPI domain master key backup is attempted, using Event ID 4692 from the originating host. Attackers can use DPAPI key backup functionality to access or unprotect protected credentials, making this activity important to monitor. The detection relies on security log telemetry that records the 4692 event at the source system rather than only on the Domain Controller.

Known false positives

If a computer is a member of a domain, DPAPI has a backup mechanism to allow unprotection of the data. Which will trigger this event.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.