SharpDPAPI Execution Detection

SigmaHQ Detections@sigmaHQ

•updated May 20, 2025•0•18

Detects the execution of the SharpDPAPI tool based on command-line flags and PE metadata. SharpDPAPI is a C# port of some DPAPI functionality from the Mimikatz project, used for extracting credentials and other sensitive information.