Suspicious Vault client DLL load

Identifies loading of the Vault client DLL by an unusual process. Adversaries can abuse the functions provided by the Credential Vault Client Library to enumerate or harvest saved credentials.

• Platform: Windows
• Severity: High
• MITRE Tactic: Credential Access
• MITRE Techniques: T1555, T1555.004

Back to all rules