alert:
- debug
description: Detects anyone attempting a backup for the DPAPI Master Key. This events gets generated at the source and not the Domain Controller.
filter:
- query:
    query_string:
      query: data.win.system.eventID:"4692"
index: wazuh-alerts-3.x-*
name: 39a94fd1-8c9a-4ff6-bf22-c058762f8014_0
priority: 1
realert:
  minutes: 0
type: any