Elastic Defend high stable eql

Suspicious Access to Windows Vault Files

Identifies an unusual process accessing Windows Vault files. Credential Lockers store credentials in encrypted .vcrd files and the encryption key can be found in a file named Policy.vpol. Adversaries may acquire credentials from Vault files.

View Source

Detection Logic

file where event.action == "open" and
   /* Credentials History */
  (file.path : ("?:\\Users\\*\\AppData\\*\\Microsoft\\Vault\\*\\*", "?:\\ProgramData\\Microsoft\\Vault\\*") and
    file.extension : ("vpol", "vcrd")) and
  user.id : ("S-1-5-21*", "S-1-12-*") and process.executable : "?:\\*" and
  not (process.code_signature.subject_name : "Geek Squad (Best Buy Stores, L.P.)" and process.code_signature.status : "trusted") and
  /* third party programs and noisy native system processes */
  not process.executable :
          ("?:\\Program Files\\*",
           "?:\\Program Files (x86)\\*",
           "?:\\Windows\\System32\\lsass.exe",
           "?:\\Windows\\System32\\svchost.exe",
           "?:\\Windows\\System32\\Robocopy.exe",
           "?:\\Windows\\ccmcache\\*.exe",
           "?:\\Windows\\CCM\\*.exe",
           "?:\\ProgramData\\Microsoft\\Windows Defender\\*.exe",
           "?:\\Windows\\System32\\dllhost.exe",
           "?:\\Users\\*\\AppData\\Local\\ESET\\ESETOnlineScanner\\ESETOnlineScanner.exe",
           "?:\\Windows\\Explorer.exe",
           "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe",
           "?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Platform\\*\\MsSense.exe",
           "?:\\Windows\\System32\\MRT.exe")

Field Validations

Loading…

Comments (0)

Loading comments...