Windows Security Log: DPAPI Domain Backup Key Extraction via LSA Secret Access

title: "Windows Security Log: DPAPI Domain Backup Key Extraction via LSA Secret Access"
id: 8f061fe4-7f13-4546-8fc5-9b75a5a2f573
status: test
description: This rule flags Windows Security events where a process reads an LSA secret object associated with DPAPI domain backup keys. Attackers can use this value to recover DPAPI-protected secrets, enabling credential and data access across domain resources. The detection relies on Event ID 4662 with object type SecretObject, a read access mask, and an object name containing BCKUPKEY.
references:
  - https://threathunterplaybook.com/hunts/windows/190620-DomainDPAPIBackupKeyExtraction/notebook.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_dpapi_domain_backupkey_extraction.yml
author: Roberto Rodriguez @Cyb3rWard0g, Huntrule Team
date: 2019-06-20
modified: 2022-02-24
tags:
  - attack.credential-access
  - attack.t1003.004
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4662
    ObjectType: SecretObject
    AccessMask: "0x2"
    ObjectName|contains: BCKUPKEY
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 4ac1f50b-3bd0-4968-902d-868b4647937e
    type: derived