Potential DPAPI Domain Backup Key Extraction via Credential Dumping Tools
Detects suspicious execution of tools or command lines associated with DPAPI domain backup key extraction, including mimikatz, SharpDPAPI, lsadump::backupkeys, and related backupkey commands. This behavior may indicate an attempt to obtain the domain DPAPI backup key from a Domain Controller, enabling decryption of DPAPI-protected secrets across the domain.
Microsoft Sentinel (KQL)
