SAM Database File Access Attempt

name: SAM Database File Access Attempt
id: 57551656-ebdb-11eb-afdf-acde48001122
version: 7
date: '2025-05-02'
author: Michael Haag, Mauricio Velazco, Splunk
status: production
type: Hunting
description: The following analytic detects attempts to access the SAM, SYSTEM, or SECURITY database files within the `windows\system32\config` directory using Windows Security EventCode 4663. This detection leverages Windows Security Event logs to identify unauthorized access attempts. Monitoring this activity is crucial as it indicates potential credential access attempts, possibly exploiting vulnerabilities like CVE-2021-36934. If confirmed malicious, an attacker could extract user passwords, leading to unauthorized access, privilege escalation, and further compromise of the system.
data_source:
    - Windows Event Log Security 4663
search: '`wineventlog_security` (EventCode=4663)  ProcessName!=*\\dllhost.exe ObjectName IN ("*\\Windows\\System32\\config\\SAM*","*\\Windows\\System32\\config\\SYSTEM*","*\\Windows\\System32\\config\\SECURITY*") | stats values(AccessList) count by ProcessName ObjectName dest src_user | rename ProcessName as process_name | `sam_database_file_access_attempt_filter`'
how_to_implement: To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure."
known_false_positives: Natively, `dllhost.exe` will access the files. Every environment will have additional native processes that do as well. Filter by process_name. As an aside, one can remove process_name entirely and add `Object_Name=*ShadowCopy*`.
references:
    - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4663
    - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934
    - https://github.com/GossiTheDog/HiveNightmare
    - https://github.com/JumpsecLabs/Guidance-Advice/tree/main/SAM_Permissions
    - https://en.wikipedia.org/wiki/Security_Account_Manager
tags:
    analytic_story:
        - Credential Dumping
        - Graceful Wipe Out Attack
        - Rhysida Ransomware
    asset_type: Endpoint
    cve:
        - CVE-2021-36934
    mitre_attack_id:
        - T1003.002
    product:
        - Splunk Enterprise
        - Splunk Enterprise Security
        - Splunk Cloud
    security_domain: endpoint
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/serioussam/windows-xml.log
          source: XmlWinEventLog:Security
          sourcetype: XmlWinEventLog