DPAPI: Windows credential decryption attacks

DPAPI, the Data Protection API, is a Windows cryptographic subsystem introduced in Windows 2000. It lets applications encrypt sensitive data without managing encryption keys directly. DPAPI ties secrets to a user or machine context using derived symmetric keys. The user-mode function CryptProtectData encrypts blobs. CryptUnprotectData decrypts them. Encryption relies on a MasterKey, itself derived from the user's password hash and a random salt. MasterKeys are stored in the user profile under AppData/Roaming/Microsoft/Protect/{SID}/. Each MasterKey file is valid for 90 days before rotation. Applications such as Chrome, Edge, Windows Credential Manager, RDP credential files, and Outlook all rely on DPAPI to protect stored secrets. In a Windows domain, a backup mechanism called the Domain Backup Key allows recovery of any user MasterKey without the original password. This makes DPAPI a high-value target. Any attacker who gains access to the MasterKey, the user password, or the domain backup key can decrypt all secrets protected by DPAPI for that scope. DPAPI is therefore not a standalone security boundary. It is a convenience layer whose strength depends entirely on the secrecy of the underlying authentication material.

Detecting DPAPI abuse requires monitoring several precise event sources. Windows Security Event 4688 logs process creation. Look for processes such as mimikatz.exe, SharpDPAPI.exe, or DonPAPI.py spawning under suspicious parent processes. Event 4624 and 4672 track logon sessions. Attackers often impersonate users or use Pass-the-Hash to access DPAPI blobs under a different security context. File system access to AppData/Roaming/Microsoft/Protect/ is a strong indicator. Configure Sysmon Event ID 11 to alert on reads of MasterKey files by unexpected processes. Access to the LSASS process memory via OpenProcess (Sysmon Event ID 10) is critical to monitor. Attackers dump LSASS to extract cached MasterKeys or the domain backup key. On domain controllers, watch for DRSUAPI replication calls and DCSync patterns in Event ID 4662. The domain DPAPI backup key is retrievable via DRSUAPI/DsGetNCChanges. Alert on any non-DC machine initiating this call. EDR telemetry should flag calls to CryptUnprotectData by unexpected processes. Correlate with network connections to identify lateral movement using decrypted credentials shortly after decryption activity.

Red Team operators target DPAPI in multiple phases of an engagement. Post-compromise, Mimikatz provides the dpapi::masterkey and dpapi::cred modules to decrypt MasterKeys using the current user context or a supplied password hash. SharpDPAPI automates bulk decryption of Chrome cookies, saved passwords, RDP credentials, and Windows Vault entries. If the attacker has domain admin privileges, retrieving the domain DPAPI backup key via Mimikatz dpapi::backupkeys or Impacket's dpapi.py unlocks every user MasterKey in the domain without needing individual passwords. This is a domain-wide credential compromise. Offline attacks are also viable. After extracting the registry hive and user profile, tools like DonPAPI or dpapilab-ng reconstruct the decryption chain locally. To harden against DPAPI abuse, enforce Credential Guard on Windows 10/11 and Server 2016 and above. Credential Guard moves secret material into a VSM-isolated process, blocking direct LSASS access. Rotate the domain DPAPI backup key regularly using the guidance in MS-BKRP. Restrict access to AppData/Roaming/Microsoft/Protect/ via ACLs. Apply attack surface reduction rules to block credential dumping. Monitor and restrict tools capable of OpenProcess calls against LSASS using application allowlisting solutions such as AppLocker or WDAC.