mdecrevoisier medium experimental sigma

Vault credentials manager accessed

Detects scenarios where an attacker attempts to access vault credentials

View Source

Detection Logic

{
  "selection": {
    "EventID": 5382
  },
  "selection_resource": {
    "Resource
| startswith": "http"
  },
  "selection_identity": {
    "Identity
| contains": "@"
  },
  "condition": "selection and (selection_resource or selection_identity)"
}

False Positives

  • ⚠ software accessing the Windows Web Password Credential

Field Validations

Loading…

Comments (0)

Loading comments...