T1003.002 Security Account Manager
Sub-technique of T1003 OS Credential Dumping
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the net user command. Enumerating the SAM database requires SYSTEM level access. A number of…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Antivirus - Password Dumper Signaturecriticalstable · antivirus
- HackTool - Credential Dumping Tools Named Pipe Createdcriticaltest · windows
- HackTool - QuarksPwDump Dump Filecriticaltest · windows
- VolumeShadowCopy Symlink Creation Via Mklinkhighstable · windows
- Copying Sensitive Files with Credential Datahightest · windows
- Cred Dump Tools Dropped Fileshightest · windows
- Credential Dumping Tools Service Execution - Securityhightest · windows
- Credential Dumping Tools Service Execution - Systemhightest · windows
- Critical Hive In Suspicious Location Access Bits Clearedhightest · windows
- Dumping of Sensitive Hives Via Reg.EXEhightest · windows
- Esentutl Volume Shadow Copy Service Keyshightest · windows
- HackTool - Mimikatz Executionhightest · windows
- HackTool - Pypykatz Credentials Dumping Activityhightest · windows
- HackTool - Quarks PwDump Executionhightest · windows
- Mimikatz Usehightest · windows
- NTDS.DIT Creation By Uncommon Processhightest · windows
- Possible Impacket SecretDump Remote Activityhightest · windows
- Possible Impacket SecretDump Remote Activity - Zeekhightest · zeek
- Potential SAM Database Dumphightest · windows
- PowerShell SAM Copyhightest · windows
- Sensitive File Dump Via Print.EXEhightest · windows
- PUA - Memory Dump Mount Via MemProcFShighexperimental · windows
- Shadow Copies Creation Using Operating Systems Utilitiesmediumtest · windows
- Transferring Files with Credential Data via Network Sharesmediumtest · windows
- Transferring Files with Credential Data via Network Shares - Zeekmediumtest · zeek
Showing 25 of 26.
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.