dpapi.json

{
  "dataset": {
    "name": "EID Quick Reference - DPAPI",
    "version": "1.2.0",
    "generatedAt": "2026-04-12T00:00:00Z",
    "id": "https://raw.githubusercontent.com/zerber0s/windows-eid-data/main/dpapi.json",
    "schema": "https://raw.githubusercontent.com/zerber0s/windows-eid-data/main/schema.json",
    "license": {
      "name": "Creative Commons Attribution 4.0 International",
      "spdx": "CC-BY-4.0",
      "notice": "Event descriptions are paraphrased summaries written for this dataset. Source links point to authoritative references."
    },
    "sources": [
      {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/",
        "type": "primary"
      }
    ]
  },
  "entries": [
    {
      "id": 4692,
      "log": "Security",
      "provider": "Microsoft-Windows-Security-Auditing",
      "channel": "Security",
      "level": "AuditSuccess",
      "title": "Backup of the DPAPI Master Key was attempted",
      "summary": "An attempt was made to back up the DPAPI Master Key.",
      "details": "Generated when a DPAPI Master Key backup is attempted. DPAPI (Data Protection API) is used by Windows to encrypt sensitive data including saved browser credentials, Wi-Fi passwords, RDP saved credentials, and application secrets. Each user has a set of DPAPI Master Keys stored in their profile (AppData\\Roaming\\Microsoft\\Protect\\<SID>). Legitimate backups occur automatically when a new master key is created or when the domain controller performs a backup via DPAPI RPC.",
      "prerequisites": [
        {
          "type": "policy",
          "description": "Enable 'Audit DPAPI Activity' under Advanced Audit Policy Configuration > Object Access. Disabled by default."
        }
      ],
      "category": "DPAPI / Credential Protection",
      "tags": [
        "dpapi",
        "master-key",
        "backup",
        "credential-access",
        "mimikatz"
      ],
      "relatedEventIds": [
        {
          "id": 4693,
          "log": "Security"
        },
        {
          "id": 4624,
          "log": "Security"
        },
        {
          "id": 10,
          "log": "Sysmon"
        },
        {
          "id": 3,
          "log": "Sysmon"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1555",
          "techniqueName": "Credentials from Password Stores",
          "tactics": [
            {
              "tacticId": "TA0006",
              "tacticName": "Credential Access"
            }
          ]
        },
        {
          "techniqueId": "T1555.003",
          "techniqueName": "Credentials from Password Stores: Credentials from Web Browsers",
          "tactics": [
            {
              "tacticId": "TA0006",
              "tacticName": "Credential Access"
            }
          ]
        },
        {
          "techniqueId": "T1552.001",
          "techniqueName": "Unsecured Credentials: Credentials In Files",
          "tactics": [
            {
              "tacticId": "TA0006",
              "tacticName": "Credential Access"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "SubjectAccountName performing a backup for a KeyIdentifier belonging to a different user's profile (different SID path) indicates cross-user credential theft",
          "Backup activity originating from an unusual process (check parent process via EID 4688) — legitimate DPAPI backups come from lsass.exe or the CryptProtectData API, not cmd.exe or PowerShell",
          "Correlate with network connections (Sysmon EID 3) from the same host to a DC on port 135/RPC at the same time — mimikatz dpapi::masterkey /rpc initiates an RPC call to the DC",
          "KeyIdentifier can be cross-referenced with the master key files in the user's Protect folder to identify which credentials are at risk"
        ],
        "commonFalsePositives": [
          "Automatic domain backup of newly created master keys by the Windows DPAPI infrastructure — occurs periodically and is normal",
          "Backup during account migration or profile restoration by authorized IT staff"
        ]
      },
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4692"
      },
      "volumeIndicator": "low",
      "windowsVersions": {
        "minVersion": "Windows Vista / Server 2008"
      },
      "keyFields": [
        {
          "name": "SubjectUserName",
          "xpath": "EventData/Data[@Name='SubjectUserName']",
          "description": "Account performing the master key backup; SYSTEM is normal for AD-backed backup, user accounts are suspicious"
        },
        {
          "name": "MasterKeyId",
          "xpath": "EventData/Data[@Name='MasterKeyId']",
          "description": "GUID of the DPAPI master key being backed up; correlate across 4692/4693 to track key lifecycle"
        },
        {
          "name": "RecoveryServer",
          "xpath": "EventData/Data[@Name='RecoveryServer']",
          "description": "DC used for the backup operation; backup to an unexpected DC or non-DC may indicate Mimikatz dpapi::masterkey /rpc"
        },
        {
          "name": "ReturnCode",
          "xpath": "EventData/Data[@Name='ReturnCode']",
          "description": "0x0 = success; non-zero indicates backup failure which may itself be suspicious"
        },
        {
          "name": "SubjectLogonId",
          "xpath": "EventData/Data[@Name='SubjectLogonId']",
          "description": "Logon session ID of the account performing the backup"
        },
        {
          "name": "BackupType",
          "xpath": "EventData/Data[@Name='BackupType']",
          "description": "Type of backup performed; 0 = recovery agent backup, 1 = domain backup via DC"
        }
      ],
      "detectionRules": [
        {
          "platform": "KQL",
          "title": "DPAPI Master Key Backup by Non-SYSTEM Account",
          "rule": "SecurityEvent\n| where EventID == 4692\n| where SubjectUserName != \"SYSTEM\"\n| project TimeGenerated, SubjectUserName, SubjectDomainName, MasterKeyId, RecoveryServer, ReturnCode, Computer",
          "notes": "SYSTEM performs legitimate AD-backed DPAPI master key backups. Any user account performing this operation is abnormal and may indicate Mimikatz 'dpapi::masterkey /rpc' usage."
        },
        {
          "platform": "Splunk",
          "title": "DPAPI Master Key Backup by Non-System Account",
          "rule": "index=wineventlog EventCode=4692 NOT Account_Name=SYSTEM\n| table _time, Account_Name, Master_Key_ID, Recovery_Server, Return_Code, host",
          "notes": "Alert on user-context DPAPI master key backup operations."
        },
        {
          "platform": "Sigma",
          "title": "DPAPI Master Key Backup by Non-System Account",
          "rule": "title: DPAPI Master Key Backup by Non-System Account\nstatus: experimental\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        EventID: 4692\n    filter_system:\n        SubjectUserName: 'SYSTEM'\n    condition: selection and not filter_system\nfalsepositives:\n    - Domain administrator performing manual key backup\nlevel: medium",
          "notes": "Low false positive rate; legitimate non-SYSTEM backups are rare. Investigate immediately."
        }
      ],
      "lastReviewed": "2026-04-10"
    },
    {
      "id": 4693,
      "log": "Security",
      "provider": "Microsoft-Windows-Security-Auditing",
      "channel": "Security",
      "level": "AuditSuccess",
      "title": "Recovery of the DPAPI Master Key was attempted",
      "summary": "An attempt was made to recover the DPAPI Master Key.",
      "details": "Generated when a DPAPI Master Key recovery is attempted. Recovery occurs when the local master key copy is unavailable (e.g., profile corruption, password reset) and the backup must be retrieved from the domain controller. Also generated by Data Recovery Agents (DRA) in PKI environments.",
      "prerequisites": [
        {
          "type": "policy",
          "description": "Enable 'Audit DPAPI Activity' under Advanced Audit Policy Configuration > Object Access. Disabled by default."
        }
      ],
      "category": "DPAPI / Credential Protection",
      "tags": [
        "dpapi",
        "master-key",
        "recovery",
        "credential-access",
        "mimikatz",
        "sekurlsa"
      ],
      "relatedEventIds": [
        {
          "id": 4692,
          "log": "Security"
        },
        {
          "id": 4624,
          "log": "Security"
        },
        {
          "id": 10,
          "log": "Sysmon"
        },
        {
          "id": 3,
          "log": "Sysmon"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1555",
          "techniqueName": "Credentials from Password Stores",
          "tactics": [
            {
              "tacticId": "TA0006",
              "tacticName": "Credential Access"
            }
          ]
        },
        {
          "techniqueId": "T1555.003",
          "techniqueName": "Credentials from Password Stores: Credentials from Web Browsers",
          "tactics": [
            {
              "tacticId": "TA0006",
              "tacticName": "Credential Access"
            }
          ]
        },
        {
          "techniqueId": "T1003",
          "techniqueName": "OS Credential Dumping",
          "tactics": [
            {
              "tacticId": "TA0006",
              "tacticName": "Credential Access"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "RecoveryServer identifies which DC processed the recovery — an unexpected DC or a DC in a different site than the user's normal location is anomalous",
          "SubjectAccountName recovering keys for an account that has not recently had a password reset or profile issue is suspicious",
          "Recovery of keys for privileged accounts (Domain Admins, service accounts with broad access) from non-standard workstations is highest priority",
          "Correlate with Sysmon EID 10 (ProcessAccess) targeting lsass.exe in the same timeframe — Mimikatz operations often touch LSASS before or after DPAPI recovery"
        ],
        "commonFalsePositives": [
          "Legitimate recovery after a user password reset that invalidates the existing master key",
          "Data Recovery Agent (DRA) operations in environments with a configured DPAPI DRA as part of PKI policy",
          "Profile restoration from backup where the master key backup must be recovered from the domain"
        ]
      },
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4693"
      },
      "volumeIndicator": "low",
      "windowsVersions": {
        "minVersion": "Windows Vista / Server 2008"
      },
      "keyFields": [
        {
          "name": "SubjectUserName",
          "xpath": "EventData/Data[@Name='SubjectUserName']",
          "description": "Account performing master key recovery; unexpected accounts recovering keys may indicate credential harvesting"
        },
        {
          "name": "MasterKeyId",
          "xpath": "EventData/Data[@Name='MasterKeyId']",
          "description": "GUID of the recovered master key; correlate with 4692 backup events to track the key's history"
        },
        {
          "name": "RecoveryServer",
          "xpath": "EventData/Data[@Name='RecoveryServer']",
          "description": "DC used for recovery; recovery from an unexpected DC is suspicious"
        },
        {
          "name": "ReturnCode",
          "xpath": "EventData/Data[@Name='ReturnCode']",
          "description": "Recovery result code; 0x0 = successful recovery, non-zero = failure"
        },
        {
          "name": "RecoveryKeyId",
          "xpath": "EventData/Data[@Name='RecoveryKeyId']",
          "description": "GUID of the recovery agent key used for the recovery operation"
        }
      ],
      "detectionRules": [
        {
          "platform": "KQL",
          "title": "DPAPI Master Key Recovery — Suspicious Account or Timing",
          "rule": "SecurityEvent\n| where EventID == 4693\n| where ReturnCode == \"0x0\"\n| where SubjectUserName != \"SYSTEM\"\n| project TimeGenerated, SubjectUserName, SubjectDomainName, MasterKeyId, RecoveryServer, Computer",
          "notes": "Successful DPAPI master key recovery by non-SYSTEM accounts. May indicate Mimikatz 'sekurlsa::dpapi' or manual credential extraction. Correlate with 4692 events for the same MasterKeyId."
        },
        {
          "platform": "Splunk",
          "title": "Successful DPAPI Master Key Recovery by Non-System Account",
          "rule": "index=wineventlog EventCode=4693 Return_Code=0x0 NOT Account_Name=SYSTEM\n| table _time, Account_Name, Master_Key_ID, Recovery_Server, host",
          "notes": "Successful key recovery by user accounts; correlate with DPAPI backup events (4692)."
        },
        {
          "platform": "Sigma",
          "title": "DPAPI Master Key Recovery by Non-System Account",
          "rule": "title: DPAPI Master Key Recovery by Non-System Account\nstatus: experimental\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        EventID: 4693\n        ReturnCode: '0x0'\n    filter_system:\n        SubjectUserName: 'SYSTEM'\n    condition: selection and not filter_system\nfalsepositives:\n    - Administrator-initiated credential recovery procedures\nlevel: medium",
          "notes": "Pair with process creation events to identify the tool performing the recovery."
        }
      ],
      "lastReviewed": "2026-04-10"
    },
    {
      "id": 4694,
      "log": "Security",
      "provider": "Microsoft-Windows-Security-Auditing",
      "channel": "Security",
      "level": "AuditSuccess",
      "title": "Protection of auditable protected data was attempted",
      "summary": "An application attempted to encrypt data using DPAPI with auditing enabled on the data.",
      "details": "Generated when CryptProtectData is called on data that was marked as auditable using the CRYPTPROTECT_AUDIT flag. This is an application-level event — most DPAPI encryption operations do not generate this event unless the application explicitly opts into DPAPI auditing by setting the audit flag. Applications that use auditable DPAPI include some credential managers, enterprise password vaults, and security-sensitive applications. This event is rare in most environments.",
      "prerequisites": [
        {
          "type": "policy",
          "description": "Enable 'Audit DPAPI Activity' under Advanced Audit Policy Configuration > Object Access. Additionally, the application must call CryptProtectData with the CRYPTPROTECT_AUDIT flag."
        }
      ],
      "category": "DPAPI / Credential Protection",
      "tags": [
        "dpapi",
        "data-protection",
        "encrypt",
        "auditable-data"
      ],
      "relatedEventIds": [
        {
          "id": 4695,
          "log": "Security"
        },
        {
          "id": 4692,
          "log": "Security"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1555",
          "techniqueName": "Credentials from Password Stores",
          "tactics": [
            {
              "tacticId": "TA0006",
              "tacticName": "Credential Access"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "ProcessName that is not a known credential manager or enterprise application encrypting data is anomalous",
          "DataDescription field (set by the calling application) may reveal what data type is being protected — unexpected descriptions from unexpected processes are suspicious",
          "Correlate SubjectAccountName with session activity — encryption by a background process in a logged-off user's context is unusual"
        ],
        "commonFalsePositives": [
          "Legitimate credential manager applications that explicitly use the CRYPTPROTECT_AUDIT flag for compliance purposes",
          "Enterprise security applications that encrypt sensitive configuration data with auditing enabled"
        ]
      },
      "keyFields": [
        {
          "name": "SubjectAccountName",
          "xpath": "EventData/Data[@Name='SubjectAccountName']",
          "description": "Account under which the CryptProtectData call was made"
        },
        {
          "name": "DataDescription",
          "xpath": "EventData/Data[@Name='DataDescription']",
          "description": "Application-provided label for the protected data; reveals what data type is being encrypted"
        },
        {
          "name": "ProcessName",
          "xpath": "EventData/Data[@Name='ProcessName']",
          "description": "Process that called CryptProtectData; identifies the application performing the encryption"
        }
      ],
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4694"
      },
      "volumeIndicator": "low",
      "windowsVersions": {
        "minVersion": "Windows Vista / Server 2008"
      },
      "lastReviewed": "2026-04-07"
    },
    {
      "id": 4695,
      "log": "Security",
      "provider": "Microsoft-Windows-Security-Auditing",
      "channel": "Security",
      "level": "AuditSuccess",
      "title": "Unprotection of auditable protected data was attempted",
      "summary": "An application attempted to decrypt DPAPI-protected auditable data.",
      "details": "Generated when CryptUnprotectData is called on data that was originally protected with the CRYPTPROTECT_AUDIT flag. This is the decryption counterpart to EID 4694. Like 4694, this event only fires when the original encryption used the audit flag, so coverage depends on application behavior.",
      "prerequisites": [
        {
          "type": "policy",
          "description": "Enable 'Audit DPAPI Activity' under Advanced Audit Policy Configuration > Object Access. Additionally, the data must have been originally encrypted with the CRYPTPROTECT_AUDIT flag."
        }
      ],
      "category": "DPAPI / Credential Protection",
      "tags": [
        "dpapi",
        "data-unprotection",
        "decrypt",
        "auditable-data",
        "credential-access"
      ],
      "relatedEventIds": [
        {
          "id": 4694,
          "log": "Security"
        },
        {
          "id": 4693,
          "log": "Security"
        },
        {
          "id": 4692,
          "log": "Security"
        },
        {
          "id": 10,
          "log": "Sysmon"
        }
      ],
      "mitreAttack": [
        {
          "techniqueId": "T1555",
          "techniqueName": "Credentials from Password Stores",
          "tactics": [
            {
              "tacticId": "TA0006",
              "tacticName": "Credential Access"
            }
          ]
        },
        {
          "techniqueId": "T1555.003",
          "techniqueName": "Credentials from Password Stores: Credentials from Web Browsers",
          "tactics": [
            {
              "tacticId": "TA0006",
              "tacticName": "Credential Access"
            }
          ]
        },
        {
          "techniqueId": "T1552.001",
          "techniqueName": "Unsecured Credentials: Credentials In Files",
          "tactics": [
            {
              "tacticId": "TA0006",
              "tacticName": "Credential Access"
            }
          ]
        }
      ],
      "notesGuidance": {
        "investigationPivots": [
          "DataDescription containing credential-related strings (browser names, 'RDP', 'password', application names) being decrypted by an unexpected ProcessName is a high-confidence credential theft indicator",
          "ProcessName that is powershell.exe, cmd.exe, or any non-browser/non-credential-manager process decrypting browser or application credentials is critical",
          "SubjectAccountName decrypting credentials belonging to a different user's data (cross-user decryption) indicates lateral credential theft",
          "Correlate with EID 4693 (master key recovery) in the same session — recovery followed immediately by decryption indicates active credential extraction"
        ],
        "commonFalsePositives": [
          "Legitimate applications decrypting their own credential stores during normal startup or authentication flows",
          "Enterprise credential managers performing routine decryption for password autofill"
        ]
      },
      "keyFields": [
        {
          "name": "SubjectAccountName",
          "xpath": "EventData/Data[@Name='SubjectAccountName']",
          "description": "Account under which the CryptUnprotectData call was made"
        },
        {
          "name": "DataDescription",
          "xpath": "EventData/Data[@Name='DataDescription']",
          "description": "Label assigned during original encryption; may reveal credential type (e.g., browser names, 'RDP password')"
        },
        {
          "name": "ProcessName",
          "xpath": "EventData/Data[@Name='ProcessName']",
          "description": "Process that called CryptUnprotectData; identifies the application performing decryption"
        }
      ],
      "source": {
        "name": "Microsoft Learn",
        "url": "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4695"
      },
      "volumeIndicator": "low",
      "windowsVersions": {
        "minVersion": "Windows Vista / Server 2008"
      },
      "lastReviewed": "2026-04-10"
    }
  ]
}