Windows Security: Network access to protected_storage via IPC share

title: "Windows Security: Network access to protected_storage via IPC share"
id: 243ce2b8-96f6-4025-b0eb-6b84cd41641d
status: test
description: This rule identifies Windows Security events where a client accesses the protected_storage service over the network, specifically targeting a share name containing 'IPC' and a RelativeTargetName of 'protected_storage'. Such access can indicate attempts to reach protected storage mechanisms that are sensitive to credential material or backup key exposure. It relies on Security event telemetry (EventID 5145) that records network share access details, including ShareName and RelativeTargetName.
references:
  - https://threathunterplaybook.com/hunts/windows/190620-DomainDPAPIBackupKeyExtraction/notebook.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_protected_storage_service_access.yml
author: Roberto Rodriguez @Cyb3rWard0g, Huntrule Team
date: 2019-08-10
modified: 2021-11-27
tags:
  - attack.lateral-movement
  - attack.t1021.002
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5145
    ShareName|contains: IPC
    RelativeTargetName: protected_storage
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 45545954-4016-43c6-855e-eae8f1c369dc
    type: derived