Suspicious access to Windows DPAPI Master Keys
Detects suspicious processes accessing the Windows Data Protection API Master keys which is a sign of potential credential stealing. DPAPI master keys are responsible for symmetric encryption of asymmetric private keys, using a user or system secret as a significant contribution of entropy. DPAPI allows developers to encrypt keys using a symmetric key derived from the user's logon secrets, or in the case of system encryption, using the system's domain authentication secrets.
- Platform: Windows
- Severity: High
- MITRE Tactic: Credential Access
- MITRE Techniques: T1555, T1555.004