name: Unusual access to Windows Credential history files
id: 9d94062f-2cf3-407c-bd65-4072fe4b167f
version: 1.0.0
description: |
  Detects unusual accesses to the Windows Credential history file.
  The CREDHIST file contains all previous password-linked master key hashes used by
  DPAPI to protect secrets on the device. Adversaries may obtain credentials
  from the Windows Credentials Manager.
labels:
  tactic.id: TA0006
  tactic.name: Credential Access
  tactic.ref: https://attack.mitre.org/tactics/TA0006/
  technique.id: T1555
  technique.name: Credentials from Password Stores
  technique.ref: https://attack.mitre.org/techniques/T1555/
  subtechnique.id: T1555.004
  subtechnique.name: Windows Credential Manager
  subtechnique.ref: https://attack.mitre.org/techniques/T1555/004/

condition: >
  open_file
    and
  file.name imatches '?:\\Users\\*\\AppData\\*\\Microsoft\\Protect\\CREDHIST'
    and
    not
  ps.exe imatches
    (
      '?:\\Program Files\\*',
      '?:\\Windows\\System32\\lsass.exe',
      '?:\\Windows\\System32\\svchost.exe',
      '?:\\Windows\\ccmcache\\*.exe'
    )

min-engine-version: 2.0.0
