domains / families / security / abusing-dpapi-for-credential-access

abusing-dpapi-for-credential-access

separate

Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.

When to use

• After compromising a Windows host where the user has saved RDP, browser, or vault credentials worth harvesting for lateral movement.
• When you hold a user's password or NTLM hash and want to decrypt their DPAPI-protected secrets offline.
• When you have Domain Admin and want to obtain the domain DPAPI backup key to decrypt any user's protected data across the estate.
• When triaging exfiltrated `Credentials`, `Vault`, or `Protect` directories from disk images.
• During purple-team exercises to validate detection of DPAPI master-key access and LSASS/Protect-folder reads.

When not to use

• Unauthorized credential extraction
• Testing systems without explicit written authorization

Skill page

Source