Protected Storage Service Access

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•2

Detects access to a protected_storage service over the network. Potential abuse of DPAPI to extract domain backup keys from Domain Controllers