DPAPI Master Key Store Accessed Outside Normal User Session
Detects access to the Windows DPAPI master key storage directory located at '\Microsoft\Protect\' by processes other than standard system components (lsass.exe, svchost.exe, dllhost.exe). Accessing these files is a common technique used by adversaries to decrypt sensitive credentials stored on the system.
Cortex XDR
