Suspicious access to Windows DPAPI Master Keys
Detects suspicious processes accessing the Windows Data Protection API Master keys which is a sign of potential credential stealing. DPAPI master keys are responsible for symmetric encryption of asymmetric private keys, using a user or system secret as a significant contribution of entropy. DPAPI allows developers to encrypt keys using a symmetric key derived from the user's logon secrets, or in the case of system encryption, using the system's domain authentication secrets.
- Plataforma: Windows
- Severidad: High
- Táctica MITRE: Acceso a credenciales
- Técnicas MITRE: T1555, T1555.004