Hayabusa high test sigma

Protected Storage Service Access

Detects access to a protected_storage service over the network. Potential abuse of DPAPI to extract domain backup keys from Domain Controllers

View Source

Detection Logic

{
  "security": {
    "Channel": "Security"
  },
  "selection": {
    "EventID": 5145,
    "ShareName
| contains": "IPC",
    "RelativeTargetName": "protected_storage"
  },
  "condition": "security and selection"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...