SharpDPAPI Triage Command Activity

The DPAPI is built into Windows operating systems and enables fast encryption of sensitive data. An attacker with administrator access runs the SharpDPAPI triage command locally, directing the command to remotely retrieve encrypted DPAPI files from the victim device by authenticating a user session over the SMB protocol. The triage command performs bulk data extraction by automatically running several smaller SharpDPAPI commands that enumerate multiple common storage locations such as the Windows Credential Manager, Windows Vaults, Remote Desktop Connection Manager, and certificates. For each found file, it sends an SMB CREATE request to remotely access the existing binary data from the file. After a successful exploit, the attacker leverages the stolen backup key to decrypt the masterkey for the victim. This step enables the attacker to access the entire set of DPAPI-protected credentials and secrets.