SilentCanvas - DPAPI Target File Access by ScreenConnect
This rule detects when the ScreenConnect process accesses DPAPI-related files, specifically those within the 'Protect\S-1-5-21-' folder. This activity is indicative of credential theft, as observed in the 'Operation SilentCanvas' campaign where a trojanized ScreenConnect was used for this purpose.
Microsoft Sentinel (KQL)
