SMB Access to Credential Store Paths: DPAPI, Browser, Cloud, Password Manager

Duo Tech@duotech

•updated Jun 29, 2026•0•0•1

Detects remote SMB access (Event ID 5145) to sensitive file paths where credentials are commonly stored, including DPAPI master keys, browser profiles, cloud provider configuration directories, and password manager data. This activity often indicates unauthorized credential discovery and staging during lateral movement or post-compromise reconnaissance.