mdecrevoisier high experimental sigma

Vault credentials manager accessed

Detects scenarios where an attacker attempts to access vault credentials.

View Source

Detection Logic

{
  "selection_powershell_native": {
    "EventID": 800,
    "EventData
| contains
| all": [
      "Windows.Security.Credentials.PasswordVault",
      "Retrieve"
    ]
  },
  "selection_powershell_modern": {
    "EventID": 4103,
    "Payload
| contains
| all": [
      "Windows.Security.Credentials.PasswordVault",
      "Retrieve"
    ]
  },
  "selection_powershell_block": {
    "EventID": 4104,
    "ScriptBlockText
| contains
| all": [
      "Windows.Security.Credentials.PasswordVault",
      "Retrieve"
    ]
  },
  "condition": "1 of selection*"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...