SharpDPAPI machine masterkey/certificate recovery execution
Detects the execution of SharpDPAPI with command-line arguments designed to perform machine-scoped DPAPI masterkey and certificate recovery. This behavior is often associated with credential theft, particularly the extraction of sensitive secrets like ADFS token-signing keys or machine credentials stored in the DPAPI system.
Microsoft Sentinel (KQL)
