DPAPI Masterkey Export Attempt

The DPAPI is built into Windows operating systems and enables fast encryption of sensitive data. The DPAPI creates a unique masterkey for each user. In an AD environment, the masterkey can be decrypted with a user domain password to access sensitive data, such as system passwords or certificates.

An attacker with domain administrator privileges can leverage attack tools such as SharpDPAPI to export the masterkey from a DC. The attacker sends an SMB READ request to the victim device that targets the DPAPI masterkey location for the user. The DPAPI also creates a backup key, which decrypts the masterkey for any user in an AD domain. Because this attack is often performed after a backup key is stolen, the remote retrieval of a masterkey indicates a broader compromise is occurring.