EXPLORE
← Back to Explore
T1003.002

Security Account Manager

Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the <code>net user</code> command. Enumerating the SAM database requires SYSTEM level access. A number of tools can be used to retrieve the SAM file through in-memory techniques: * pwdumpx.exe * ...

Windows
45
Detections
4
Sources
13
Threat Actors

BY SOURCE

26sigma10elastic8splunk_escu1crowdstrike_cql

PROCEDURES (30)

Dump4 detections

Auto-extracted: 4 detections for dump

Registry3 detections

Auto-extracted: 3 detections for registry

Api2 detections

Auto-extracted: 2 detections for api

Event Log2 detections

Auto-extracted: 2 detections for event log

Shadow Cop2 detections

Auto-extracted: 2 detections for shadow cop

Service2 detections

Auto-extracted: 2 detections for service

Script Block2 detections

Auto-extracted: 2 detections for script block

Credential2 detections

Auto-extracted: 2 detections for credential

Registry2 detections

Auto-extracted: 2 detections for registry

Ntds2 detections

Auto-extracted: 2 detections for ntds

Suspicious2 detections

Auto-extracted: 2 detections for suspicious

Dump2 detections

Auto-extracted: 2 detections for dump

File Monitoring1 detections

Auto-extracted: 1 detections for file monitoring

Exfiltrat1 detections

Auto-extracted: 1 detections for exfiltrat

Ntds1 detections

Auto-extracted: 1 detections for ntds

Shadow Cop1 detections

Auto-extracted: 1 detections for shadow cop

Remote1 detections

Auto-extracted: 1 detections for remote

Exfiltrat1 detections

Auto-extracted: 1 detections for exfiltrat

Lateral1 detections

Auto-extracted: 1 detections for lateral

Azure1 detections

Auto-extracted: 1 detections for azure

Credential1 detections

Auto-extracted: 1 detections for credential

Mimikatz1 detections

Auto-extracted: 1 detections for mimikatz

Lateral1 detections

Auto-extracted: 1 detections for lateral

Service1 detections

Auto-extracted: 1 detections for service

Dump1 detections

Auto-extracted: 1 detections for dump

Mimikatz1 detections

Auto-extracted: 1 detections for mimikatz

Dump1 detections

Auto-extracted: 1 detections for dump

Mimikatz1 detections

Auto-extracted: 1 detections for mimikatz

Dump1 detections

Auto-extracted: 1 detections for dump

Remote1 detections

Auto-extracted: 1 detections for remote

DETECTIONS (45)

Antivirus Password Dumper Detection
sigmacritical
Azure AD Privileged Authentication Administrator Role Assigned
splunk_escu
Azure AD Privileged Graph API Permission Assigned
splunk_escu
Copying Sensitive Files with Credential Data
sigmahigh
Crash Dump Created By Operating System
sigmamedium
Cred Dump Tools Dropped Files
sigmahigh
Credential Acquisition via Registry Hive Dumping
elastichigh
Credential Dumping Detection
crowdstrike_cql
Credential Dumping Tools Service Execution - Security
sigmahigh
Credential Dumping Tools Service Execution - System
sigmahigh
Critical Hive In Suspicious Location Access Bits Cleared
sigmahigh
Detect Copy of ShadowCopy with Script Block Logging
splunk_escu
Dumping of Sensitive Hives Via Reg.EXE
sigmahigh
Esentutl SAM Copy
splunk_escu
Esentutl Volume Shadow Copy Service Keys
sigmahigh
HackTool - Credential Dumping Tools Named Pipe Created
sigmacritical
HackTool - Mimikatz Execution
sigmahigh
HackTool - Pypykatz Credentials Dumping Activity
sigmahigh
HackTool - Quarks PwDump Execution
sigmahigh
HackTool - QuarksPwDump Dump File
sigmacritical
Mimikatz Use
sigmahigh
NTDS Dump via Wbadmin
elasticmedium
NTDS or SAM Database File Copied
elastichigh
NTDS.DIT Creation By Uncommon Process
sigmahigh
O365 Privileged Graph API Permission Assigned
splunk_escu
Possible Impacket SecretDump Remote Activity
sigmahigh
Possible Impacket SecretDump Remote Activity - Zeek
sigmahigh
Potential Credential Access via Trusted Developer Utility
elastichigh
Potential Remote Credential Access via Registry
elastichigh
Potential SAM Database Dump
sigmahigh
PowerShell Invoke-NinjaCopy script
elastichigh
PowerShell SAM Copy
sigmahigh
SAM Database File Access Attempt
splunk_escu
Sensitive Registry Hive Access via RegBack
elastichigh
Shadow Copies Creation Using Operating Systems Utilities
sigmamedium
Suspicious Remote Registry Access via SeBackupPrivilege
elasticmedium
Symbolic Link to Shadow Copy Created
elasticmedium
Transferring Files with Credential Data via Network Shares
sigmamedium
Transferring Files with Credential Data via Network Shares - Zeek
sigmamedium
Volume Shadow Copy Mount
sigmalow
VolumeShadowCopy Symlink Creation Via Mklink
sigmahigh
VSSAudit Security Event Source Registration
sigmainformational
Windows Rapid Authentication On Multiple Hosts
splunk_escu
Windows Registry File Creation in SMB Share
elasticmedium
Windows Sensitive Registry Hive Dump Via CommandLine
splunk_escu