Access To Windows Credential History File By Uncommon Applications

SigmaHQ Detections@sigmaHQ

•updated Jun 2, 2025•0•0•0

Detects file access requests to the Windows Credential History File by an uncommon application. This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::credhist" function