Protected Storage Service Access — Detection Rule

Detects access to a protected_storage service over the network. Potential abuse of DPAPI to extract domain backup keys from Domain Controllers

Read the full analysis on IntelFusions