DPAPI Backup Keys And Certificate Export Activity IOC (7892ec59-c5bb-496d-8968-e5d210ca3ac4)

Detects file names with specific patterns seen generated and used by tools such as Mimikatz and DSInternals related to exported or stolen DPAPI backup keys and certificates.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
DPAPI Backup Keys And Certificate Export Activity IOC (7892ec59-c5bb-496d-8968-e5d210ca3ac4)	Sigma-Rules	Private Keys - T1552.004 (60b508a1-6a5e-46b1-821a-9f7b78752abf)	Attack Pattern	1
DPAPI Backup Keys And Certificate Export Activity IOC (7892ec59-c5bb-496d-8968-e5d210ca3ac4)	Sigma-Rules	Credentials from Password Stores - T1555 (3fc9b85a-2862-4363-a64d-d692e3ffbee0)	Attack Pattern	1
Unsecured Credentials - T1552 (435dfb86-2697-4867-85b5-2fef496c0517)	Attack Pattern	Private Keys - T1552.004 (60b508a1-6a5e-46b1-821a-9f7b78752abf)	Attack Pattern	2