// Detection

Credential store access

Direct access to a credential store or secrets material, outside the normal path applications use to retrieve them.

CriticalInvestigating0alerts raisedSignature

Armed

What this rule does

Rendered from the stored logic, so it cannot drift from what executes.

Any event where eventType is CREDENTIAL_ACCESS

{
  "kind": "match",
  "where": [
    {
      "op": "eq",
      "field": "eventType",
      "value": "CREDENTIAL_ACCESS"
    }
  ]
}

Backtest before saving. Alerts already raised keep their original descriptions: they record what the rule found at the time.

NameSeverity

Description

CategoryATT&CK tacticTechnique

Logic

Fields: eventType, username, sourceIp, destinationIp, hostname, processName, commandLine, parentProcess, action, status, country, city

What this rule has actually caught.

Armed, but nothing in the retained window has matched it.