Windows Security Event 4662 Detects DPAPI Domain Backup Key Extraction from Domain Controllers
Detects read access to LSA secret DPAPI domain backup key objects in Windows Event ID 4662.
- Product
- windows
- Service
- security
- Author
- Roberto Rodriguez @Cyb3rWard0g (SigmaHQ), DRL 1.1
- Published
- 2019-06-20
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies access to a DPAPI domain backup key stored as a secret object on Windows Domain Controllers by matching Security Event 4662 fields. Attackers may extract DPAPI domain backup keys to enable decryption of protected credentials across accounts. The detection relies on Windows Security auditing telemetry for object access to SecretObject values containing BCKUPKEY, including the specific access mask.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Security Event 4662 Detects DPAPI Domain Backup Key Extraction from Domain Controllers
id: 8f061fe4-7f13-4546-8fc5-9b75a5a2f573
status: test
description: This rule identifies access to a DPAPI domain backup key stored as a secret object on Windows Domain Controllers by matching Security Event 4662 fields. Attackers may extract DPAPI domain backup keys to enable decryption of protected credentials across accounts. The detection relies on Windows Security auditing telemetry for object access to SecretObject values containing BCKUPKEY, including the specific access mask.
references:
- https://threathunterplaybook.com/hunts/windows/190620-DomainDPAPIBackupKeyExtraction/notebook.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_dpapi_domain_backupkey_extraction.yml
author: Roberto Rodriguez @Cyb3rWard0g, Huntrule Team
date: 2019-06-20
modified: 2022-02-24
tags:
- attack.credential-access
- attack.t1003.004
logsource:
product: windows
service: security
detection:
selection:
EventID: 4662
ObjectType: SecretObject
AccessMask: "0x2"
ObjectName|contains: BCKUPKEY
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 4ac1f50b-3bd0-4968-902d-868b4647937e
type: derived