AN1198
Analytic 1198
Windows
Monitors suspicious access to password stores such as LSASS, DPAPI, Windows Credential Manager, or browser credential databases. Detects anomalous process-to-process access (e.g., Mimikatz accessing LSASS) and correlation of credential store file reads with execution of non-standard processes.
WinEventLog:Sysmon
EventCode=10
WinEventLog:Security
EventCode=4663, 4670, 4656
WinEventLog:Sysmon
EventCode=1
[TargetProcesses]
List of sensitive processes to monitor (e.g., lsass.exe, svchost.exe)
[KeywordPatterns]
Regex for suspicious command-line arguments such as 'dpapi', 'credman', 'mimikatz'
AN1199
Analytic 1199
Linux
Detects access to known password store files (e.g., /etc/shadow, GNOME Keyring, KWallet, browser credential databases). Monitors anomalous process read attempts and suspicious API calls that attempt to extract stored credentials.
auditd:SYSCALL
open/read
auditd:EXECVE
execve
[MonitoredFiles]
Paths to password storage files (e.g., /etc/shadow, ~/.local/share/keyrings/)
[SuspiciousCommands]
Process or command-line keywords that indicate password extraction attempts
AN1200
Analytic 1200
macOS
Monitors Keychain database access and suspicious invocations of security and osascript utilities. Correlates process execution with attempts to dump or unlock Keychain data.
macos:unifiedlog
access to keychain database
macos:unifiedlog
execution of security or osascript
[AllowedApplications]
Whitelist of legitimate processes accessing the Keychain
[AlertThreshold]
Number of failed access attempts before raising an alert
AN1201
Analytic 1201
IaaS
Detects attempts to access or enumerate cloud password/secrets storage services such as AWS Secrets Manager, Azure Key Vault, or GCP Secret Manager. Monitors API calls for abnormal enumeration or bulk retrieval of secrets.
AWS:CloudTrail
GetSecretValue
AWS:CloudTrail
Decrypt
[UserContext]
Correlate cloud API calls with IAM role, user, or service account context
[AccessThreshold]
Number of secret retrievals within a time window before flagging