DPAPI Domain Backup Key Extraction from Domain Controllers

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•29

Detects attempts to extract the LSA secret DPAPI domain backup key from Domain Controllers. This activity is indicative of an adversary trying to gain access to sensitive cryptographic keys that can be used to decrypt DPAPI-protected data across the domain.