Credential Manager Access By Uncommon Applications

This brief details a detection rule from SigmaHQ designed to identify suspicious access to Windows credential manager and vault files, a strong indicator of credential theft attempts. This activity is frequently associated with post-exploitation tools, such as Mimikatz, which can dump cached credentials (e.g., using its "dpapi::cred" function). The detection specifically targets processes that are not part of common system directories (like C:\Program Files or C:\Windows\system32) or explorer.exe, when they attempt to access specific AppData and ProgramData paths where sensitive credentials and vault data are stored. This type of activity is critical for defenders to monitor, as stolen credentials can facilitate lateral movement, privilege escalation, and further compromise within an organization's environment.

Impact

Successful credential theft allows attackers to gain unauthorized access to user accounts, services, and sensitive data. This compromise can facilitate lateral movement within the network, escalate attacker privileges, and ultimately lead to data exfiltration, complete system compromise, or the deployment of further malicious payloads such as ransomware. The number of potential victims can range from a single compromised user to an entire organization, depending on the scope of the credential theft and the privileges associated with the stolen credentials. Industries targeted by credential theft are typically broad, as this is a foundational tactic in the vast majority of cyberattacks.

Recommendation

• Deploy the Credential Manager Access By Uncommon Applications Sigma rule to your SIEM to detect suspicious access patterns to credential manager files.
• Ensure the Microsoft-Windows-Kernel-File ETW provider is enabled on Windows endpoints to provide the necessary file access logging for this detection rule.
• Review logs for file_access events related to \AppData\Local\Microsoft\Credentials\, \AppData\Roaming\Microsoft\Credentials\, \AppData\Local\Microsoft\Vault\, and \ProgramData\Microsoft\Vault\ originating from processes outside standard system directories.