Access To Windows Credential History File By Uncommon Applications

Title: Access To Windows Credential History File By Uncommon Applications
Status: test
Description:Detects file access requests to the Windows Credential History File by an uncommon application. This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::credhist" function
References:
  -https://tools.thehacker.recipes/mimikatz/modules/dpapi/credhist
  -https://www.passcape.com/windows_password_recovery_dpapi_credhist
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-17
modified:2024-07-29
Tags:

• -'attack.credential-access'
• -'attack.t1555.004'

Logsource:

• category: file_access
• product: windows
• definition: Requirements: Microsoft-Windows-Kernel-File ETW provider

Detection:
  selection:
    FileName|endswith: '\Microsoft\Protect\CREDHIST'
  filter_main_system_folders:
    Image|startswith:
      -'C:\Program Files\'
      -'C:\Program Files (x86)\'
      -'C:\Windows\system32\'
      -'C:\Windows\SysWOW64\'

  filter_main_explorer:
    Image: 'C:\Windows\explorer.exe'
  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Unknown
Level: medium