Access To Windows Credential History File By Uncommon Applications

SigmaHQ Detections@sigmaHQ

•updated Jun 2, 2025•0•27

Detects file access requests to the Windows Credential History File by an uncommon application. This can be a sign of credential stealing, for example, the usage of Mimikatz's "dpapi::credhist" function. The rule filters out common legitimate system processes and applications to reduce false positives.