DPAPI Domain Master Key Backup Attempt

SigmaHQ Detections@sigmaHQ

•updated Nov 24, 2025•0•0•0

Detects anyone attempting a backup for the DPAPI Master Key. This events gets generated at the source and not the Domain Controller.