Sigma rule: Credential Manager Access By Uncommon Applications

Rule

Title

Credential Manager Access By Uncommon Applications

Status

test

Level

medium

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2022-10-11

Modified

2026-07-28

File

rules/windows/file/file_access/file_access_win_susp_credential_manager_access.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious processes based on name and location that access the windows credential manager and vault.
Which can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::cred" function

Log source

product

windows

category

file_access

definition

Requirements: Microsoft-Windows-Kernel-File ETW provider

Detection

selection:
    FileName|contains:
        - '\AppData\Local\Microsoft\Credentials\'
        - '\AppData\Roaming\Microsoft\Credentials\'
        - '\AppData\Local\Microsoft\Vault\'
        - '\ProgramData\Microsoft\Vault\'
filter_main_system_folders:
    Image|startswith:
        - 'C:\Program Files\'
        - 'C:\Program Files (x86)\'
        - 'C:\Windows\system32\'
        - 'C:\Windows\SysWOW64\'
filter_main_explorer:
    Image: 'C:\Windows\explorer.exe'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Legitimate software installed by the users for example in the "AppData" directory may access these files (for any reason).

Tags

• attack.t1003
• attack.credential-access

MITRE ATT&CK ids this rule names

• T1003

References

• https://hunter2.gitbook.io/darthsidious/privilege-escalation/mimikatz
• https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_access/file_access_win_susp_credential_manager_access.yml