Access To Windows DPAPI Master Keys By Uncommon Applications

SigmaHQ Detections@sigmaHQ

•updated Jul 28, 2026•0•0•5

Detects file access requests to the the Windows Data Protection API Master keys by an uncommon application. This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::masterkey" function