Offensive DPAPI With Nemesis
ID: da2e1a36-cd21-5fcb-833b-cf4fdc27a3cd
STIX ID: report--da2e1a36-cd21-5fcb-833b-cf4fdc27a3cd
Feed Name: SpecterOps Blog
Threat Score
Nemesis 2.2 automates the complete DPAPI decryption chain on Windows — from SYSTEM and user masterkeys through CNG-based Chromekey1 — and supports retroactive decryption of Chromium Local State and Login Data to enable cookie and credential recovery; the post details supported file-based extraction methods (SYSTEM/SECURITY hives, LSASS dumps, CNG SystemKeys), submission workflows, and limitations (TPM/CNG protection, requirement for SYSTEM or domain-level material).
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.