Unusual access to Windows Credential history files

Detects unusual accesses to the Windows Credential history file. The CREDHIST file contains all previous password-linked master key hashes used by DPAPI to protect secrets on the device. Adversaries may obtain credentials from the Windows Credentials Manager.

• Plataforma: Windows
• Severidad: High
• Táctica MITRE: Acceso a credenciales
• Técnicas MITRE: T1555, T1555.004

Volver a todas las reglas