The Gentlemen - DPAPI Backup Key Extraction
Detects execution of Impacket dpapi.py with backupkeys parameter, used by The Gentlemen to extract DPAPI backup keys from domain controllers for decrypting stored credentials across the domain.
YARA-L
Detects execution of Impacket dpapi.py with backupkeys parameter, used by The Gentlemen to extract DPAPI backup keys from domain controllers for decrypting stored credentials across the domain.
Already have an account?