How do you detect DPAPI domain backup key extraction?

Detect it on the Domain Controller by watching the two retrieval paths. For the RPC path, alert on IPC$ access to the protected_storage pipe (Event 5145) or MS-BKRP BackuprKey calls from hosts that are not ordinary baselined workstations. For the direct path, collect the objectGUIDs of the BCKUPKEY secret objects and alert on Event 4662 reads by anyone other than a DC account. Treat a confirmed extraction as a long-lived compromise, because the domain backup key is not rotated routinely.

Detecting DPAPI Domain Backup Key Extraction

Each domain holds a DPAPI backup key as LSA secret objects on the Domain Controllers. With it, an attacker can decrypt saved browser credentials, certificates and other DPAPI-protected data for any domain user, offline and indefinitely. Tools retrieve it over the backup key RPC interface or by reading the secret objects directly, and both paths can be watched.

Signals at a Glance

Signal	Where	ATT&CK
MS-BKRP BackuprKey calls to a DC from an unexpected host	Zeek dce_rpc, network	T1003.004
IPC$ access to the protected_storage pipe on a DC	DC Security 5145	T1003.004
4662 reads of the G$BCKUPKEY secret objects in CN=System	DC Security 4662	T1003.004
LSA secret retrieval over lsarpc by a non-DC account	DC Security 4662, 5145	T1003.004
DPAPI master-key decryption activity soon after a DC logon	EDR, endpoint telemetry	T1555

The RPC Path

The backup key protocol (MS-BKRP) is served on the protected_storage named pipe, and its UUID is 3dde7c30-165d-11d1-ab8f-00805f14db40. Ordinary clients use it to recover master keys, so the baseline is not zero, but it comes from workstations at low volume. Calls from servers, admin jump hosts or one host at high rate are the outliers:

title: Access To protected_storage Pipe On Domain Controller
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5145
    ShareName|endswith: '\IPC$'
    RelativeTargetName: 'protected_storage'
  filter_known:
    IpAddress|startswith: '10.20.'   # tune/validate: workstation ranges you baselined
  condition: selection and not filter_known
level: medium
# Pair with Zeek dce_rpc uuid 3dde7c30-165d-11d1-ab8f-00805f14db40 for the wire view.

Reading the Secret Objects

The key material is stored as secret-class objects in the System container, with names starting BCKUPKEY_. Event ID 4662 records the object by GUID, not by name, so first collect the GUIDs of those objects and then match on them. Directory-service access auditing and a SACL on the objects are required:

// tune/validate: replace with objectGUID values from
//   Get-ADObject -SearchBase "CN=System,<domain DN>" -LDAPFilter "(name=BCKUPKEY*)" -Properties objectGUID
let backupKeyGuids = dynamic(["00000000-0000-0000-0000-000000000001",
                              "00000000-0000-0000-0000-000000000002"]);
let dcs = dynamic(["DC01$","DC02$"]);
SecurityEvent
| where EventID == 4662
| where ObjectServer == "DS"
| where tolower(ObjectName) has_any (backupKeyGuids)
| where SubjectUserName !in (dcs)
| project TimeGenerated, Computer, SubjectUserName, SubjectLogonId, ObjectName, AccessMask

Treat a confirmed extraction as a major incident: the domain backup key has no routine rotation, so assume DPAPI data for domain users is readable.
Combine with DCSync and domain-admin logon detections; the same intrusion usually produces all three.
Restrict interactive and remote access to Domain Controllers, since both retrieval routes need privileged access to one.
Re-encrypt high-value secrets that rely on DPAPI alone, and rotate credentials stored in browsers or credential managers after an incident.

Vetted sources

Use the SigmaHQ and Elastic DPAPI and LSA secret rules, Splunk ESCU credential-access analytics, the Microsoft MS-BKRP protocol documentation and Mimikatz and DPAPI research for the retrieval methods. Baseline your own environment — client master-key recovery uses the same pipe, so alert on source role and volume, not on the pipe alone.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

The RPC Path

Reading the Secret Objects

Build Detections That Fire

Active Directory Attack Detection

Detection Hub

DCSync Detection