DPAPI secret theft

DPAPI-protected blobs (browser creds, keys) decrypted with user or backup master keys

categoryIdentity, authentication and credential attacksseverityHighdetectability (measured in our lab)Mediumlabdetected in lab

Example: THEFT2/3

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1555 · Enumerate credentials from Windows Credential Manager using vaultcmd.exe [Web Credentials] · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1555 -Tool atomic -RunId <run-id> -Command 'Invoke-AtomicTest T1555 -TestGuids bc071188-459f-44d5-901a-f8f2625b2d2e -TimeoutSeconds 120'

ATT&CK T1555 · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1555 -Tool atomic -RunId run-2026-10-14-025 -Command 'Invoke-AtomicTest T1555 -TestGuids bc071188-459f-44d5-901a-f8f2625b2d2e -TimeoutSeconds 120'

ATT&CK T1555 · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1555 -Tool atomic -RunId run-2026-10-16-003 -Command 'Invoke-AtomicTest T1555 -TestGuids bc071188-459f-44d5-901a-f8f2625b2d2e -TimeoutSeconds 120'

+ 1 more test variant(s) in the corpus.

What our lab measured

detected windows · 2026-10-27 · detected in 45s

What it looked like in telemetry

Log source	What it means
Sysmon · EID 1	Powershell process spawned powershell instance
Sysmon · EID 1	Windows Credential Manager enumeration: vaultcmd /listcreds (web/vault credential listing)
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
PowerShell · EID 4104	Powershell script querying system environment variables
PowerShell · EID 4104	Powershell script recursively collected files from a filesystem search
PowerShell · EID 4104	Powershell script searching filesystem
PowerShell · EID 4104	Powershell script used "Invoke-command" cmdlet to execute sub script
Security · EID 4624	Non network or service local logon.
… and 4 more event type(s)

Detection that fired

✓ Wazuh 100402 (level 8) lab rule — Windows Credential Manager enumeration: vaultcmd /listcreds (web/vault credential listing)

Plus 11 stock Wazuh/Sysmon rule(s) in the window.

⚠ Gap: rule 100401 was expected but did not fire in this run — the telemetry above is the hunt surface, not a solved detection.

Background noise in the window: ~70468 incidental alerts/hour — tune against this.

detected windows · 2026-10-16 · detected in 5s

What it looked like in telemetry

Log source	What it means
Sysmon · EID 1	Access token manipulation: SYSTEM-integrity process created by a non-service parent
Sysmon · EID 1	Powershell process spawned powershell instance
Sysmon · EID 1	Windows Credential Manager enumeration: vaultcmd /listcreds (web/vault credential listing)
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
PowerShell · EID 4104	Powershell script querying system environment variables
PowerShell · EID 4104	Powershell script recursively collected files from a filesystem search
Security · EID 4624	Non network or service local logon.
Security · EID 4634	Non service account logged off.
… and 1 more event type(s)

Detection that fired

✓ Wazuh 100230 (level 10) lab rule — Access token manipulation: SYSTEM-integrity process created by a non-service parent
✓ Wazuh 100402 (level 8) lab rule — Windows Credential Manager enumeration: vaultcmd /listcreds (web/vault credential listing)

Plus 7 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~568 incidental alerts/hour — tune against this.

Classification

27 values: 2 lab-measured, 11 imported, 1 derived, 13 machine-classified. What do these mean?

Exploitability

Attack vector	Credential attacks
Reach (CVSS)	Local
Attack complexity	Low
Privileges required	Low
User interaction	None
Attacker skill required	Medium
Resources required	Low
Likelihood / prevalence	Medium
Maturity	Established

Impact & scope

Severity	High
Impact	Confidentiality
Platform	IaaSLinuxmacOSWindows
Environment	On-premises
Target asset class	EndpointIdentity
Kill-chain phase (tactic)	Credential Access

Detection & telemetry

Detectability (measured in our lab)	Medium
Detectability (public detection content)	High
Noise level	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	Cloud Service EnumerationFile AccessOS API ExecutionProcess AccessProcess Creation

Detection & response

Mitigated by 18

M1026 attack-mitigation
M1027 attack-mitigation
M1051 attack-mitigation
D3-CF d3fend
D3-CM d3fend
D3-CQ d3fend
D3-DF d3fend
D3-DI d3fend
D3-FA d3fend
D3-FE d3fend
D3-FEV d3fend
D3-FIM d3fend
D3-LFP d3fend
D3-RD d3fend
D3-RF d3fend
D3-RFAM d3fend
D3-SCA d3fend
D3-SCF d3fend

Detected by 22

DET0430 attack-detection-strategy
24c77512-782b-448a-8950-eddb0785fc71 sigma
46612ae6-86be-4802-bc07-39b59feb1309 sigma
47147b5b-9e17-4d76-b8d2-7bac24c5ce1b sigma
4b60e527-ec73-4b47-8cb3-f02ad927ca65 sigma
58f4ea09-0fc2-4520-ba18-b85c540b0eaf sigma
58f50261-c53b-4c88-bd12-1d71f12eda4c sigma
603c6630-5225-49c1-8047-26c964553e0e sigma
7679d464-4f74-45e2-9e01-ac66c5eb041a sigma
77564cc2-7382-438b-a7f6-395c2ae53b9a sigma
7892ec59-c5bb-496d-8968-e5d210ca3ac4 sigma
7a2a22ea-a203-4cd3-9abf-20eb1c5c6cd2 sigma
851fd622-b675-4d26-b803-14bc7baa517a sigma
99c49d9c-34ea-45f7-84a7-4751ae6b2cbc sigma
a1dfd976-4852-41d4-9507-dc6590a3ccd0 sigma
a4694263-59a8-4608-a3a0-6f8d3a51664c sigma
a840e606-7c8c-4684-9bc1-eb6b6155127f sigma
b120b587-a4c2-4b94-875d-99c9807d6955 sigma
d0dae994-26c6-4d2d-83b5-b3c8b79ae513 sigma
d557dc06-62e8-4468-a8e8-7984124908ce sigma
fc028194-969d-4122-8abe-0470d5b8f12f sigma
100402 wazuh

Tested by 34

079ee2e9-6f16-47ca-a635-14efcd994118 atomic
124e13e5-d8a1-4378-a6ee-a53cd0c7e369 atomic
1864fdec-ff86-4452-8c30-f12507582a93 atomic
1b83cddb-eaa7-45aa-98a5-85fb0a8807ea atomic
234f9b7c-b53d-4f32-897b-b880a6c9ea7b atomic
28498c17-57e4-495a-b0be-cc1e36de408b atomic
29d0c390-3cbc-4e4e-a52b-a1350ed836b7 atomic
36753ded-e5c4-4eb5-bc3c-e8fba236878d atomic
3d111226-d09a-4911-8715-fe11664f960d atomic
4a16a770-c1fc-494a-8131-022a0b147b3a atomic
5c32102a-c508-49d3-978f-288f8a9f6617 atomic
6f2c5c87-a4d5-4898-9bd1-47a55ecaf1dd atomic
70422253-8198-4019-b617-6be401b49fce atomic
764ea176-fb71-494c-90ea-72e9d85dce76 atomic
87e88698-621b-4c45-8a89-4eaebdeaabb1 atomic
88e1fa00-bf63-4e5b-a3e1-e2ea51c8cca6 atomic
8c05b133-d438-47ca-a630-19cc464c4622 atomic
8fd5a296-6772-4766-9991-ff4e92af7240 atomic
9a2915b3-3954-4cce-8c76-00fbf4dbd014 atomic
9c2dd36d-5c8b-4b29-8d72-a11b0d5d7439 atomic
a6a5ec26-a2d1-4109-9d35-58b867689329 atomic
afe369c2-b42e-447f-98a3-fb1f4e2b8552 atomic
bc071188-459f-44d5-901a-f8f2625b2d2e atomic
c1402f7b-67ca-43a8-b5f3-3143abedc01b atomic
c89becbe-1758-4e7d-a0f4-97d2188a23e3 atomic
db965264-3117-4bad-b7b7-2523b7856b92 atomic
dc9cd677-c70f-4df5-bd1c-f114af3c2381 atomic
e359627f-2d90-4320-ba5e-b0f878155bbe atomic
e544bbcb-c4e0-4bd0-b614-b92131635f59 atomic
e5e3d639-6ea8-4408-9ecd-d5a286268ca0 atomic
eb8da98a-2e16-4551-b3dd-83de49baa14c atomic
ec1d0b37-f659-4186-869f-31a554891611 atomic
f543635c-1705-42c3-b180-efd6dc6e7ee7 atomic
fa714db1-63dd-479e-a58e-7b2b52ca5997 atomic

Attack relationships

Child: Credentials from password stores / vaults
Child: Infostealer

Lab findings

Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.

Run	Outcome	Tool	Platform	Ran at
`run-2026-10-14-025`	partially-detected	atomic	windows	2026-10-14
`run-2026-10-16-003`	detected	atomic	windows	2026-10-16
`run-2026-10-27-025`	detected	atomic	windows	2026-10-27

run-2026-10-14-025 — Backlog detectability-baseline probe (priority 5, 2 corpus attack(s); atomic_tests=9). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1555 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=15 max_level=15 dwell_s=90
run-2026-10-16-003 — Backlog detectability-baseline probe (priority 5, 2 corpus attack(s); atomic_tests=9). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1555 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=1 incidental=15 max_level=15 dwell_s=90
run-2026-10-27-025 — Backlog detectability-baseline probe (priority 5, 2 corpus attack(s); atomic_tests=9). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1555 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=1 incidental=1840 max_level=15 dwell_s=90

Framework references

Primary source: https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf
attack: T1555 (primary)

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Identity, authentication and credential attacks' table, line 337 of Cyber-Attack-Taxonomy.md
ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1555 as the nearest framework entries; ids verified to exist in the cached catalogues.
ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 40 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0004 (Phase 4 detection lab - detonation runs 2026-10-14) — Lab detonation run-2026-10-14-025 (partially-detected) for T1555: no alert matched the expected technique
ev-0005 (Phase 4 detection lab - detonation runs 2026-10-16) — Lab detonation run-2026-10-16-003 (detected): Wazuh rule(s) 100402 fired on T1555 within the detonation window
Windows Credential Manager enumeration: vaultcmd /listcreds (web/vault credential listing)
ev-0006 (Phase 4 detection lab - detonation runs 2026-10-27) — Lab detonation run-2026-10-27-025 (detected): Wazuh rule(s) 100402 fired on T1555 within the detonation window
Windows Credential Manager enumeration: vaultcmd /listcreds (web/vault credential listing)