DPAPI Domain Backup Key Extraction
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects tools extracting LSA secret DPAPI domain backup key from Domain Controllers
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Operation Performed on Object" AND OBJECTTYPE = "SecretObject" AND ACCESSMASK = "0x2" AND OBJECTNAME contains "BCKUPKEY" select Action1.HOSTNAME,Action1.MESSAGE,Action1.USERNAME,Action1.DOMAIN,Action1.ACCESSES,Action1.OBJECTNAME,Action1.OBJECTTYPE
Detection
Execution Mode
realtime
Log Sources
Active Directory
Author
Roberto Rodriguez @Cyb3rWard0g
