Detect Security Account Manager in Google Chronicle
Adversaries attempt to extract credential material from the Security Account Manager (SAM) database containing local account NTLM hashes. The SAM requires SYSTEM-level access. Methods include: registry export (reg save HKLM\sam; reg save HKLM\system), Volume Shadow Copy access, Mimikatz lsadump::sam, secretsdump.py, gsecdump, pwdump, and creddump7. Used by APT29, APT41, Daggerfly, GALLIUM, Wizard Spider, Ember Bear, Agrius, and ransomware operators universally. Combined with the SYSTEM hive, SAM allows offline hash extraction.
MITRE ATT&CK
- Tactic
- Credential Access
- Technique
- T1003 OS Credential Dumping
- Sub-technique
- T1003.002 Security Account Manager
- Canonical reference
- https://attack.mitre.org/techniques/T1003/002/
YARA-L Detection Query
rule t1003_002_sam_credential_dumping {
meta:
author = "Detection Engineering"
description = "Detects SAM database credential dumping via registry export, Mimikatz, VSS shadow copy, or ESENTUTL/NTDSUTIL abuse"
mitre_attack_tactic = "Credential Access"
mitre_attack_technique = "T1003.002"
severity = "CRITICAL"
priority = "HIGH"
events:
$e.metadata.event_type = "PROCESS_LAUNCH"
$e.principal.process.file.full_path != ""
(
(
re.regex($e.principal.process.file.full_path, `(?i)reg\.exe$`) and
(
re.regex($e.target.process.command_line, `(?i)save.*hklm\\sam`) or
re.regex($e.target.process.command_line, `(?i)save.*hklm\\system`) or
re.regex($e.target.process.command_line, `(?i)save.*hklm\\security`)
)
) or
re.regex($e.target.process.command_line, `(?i)(lsadump::sam|lsadump::cache|sekurlsa::msv)`) or
(
re.regex($e.principal.process.file.full_path, `(?i)vssadmin\.exe$`) and
re.regex($e.target.process.command_line, `(?i)(create shadow|list shadow)`)
) or
(
re.regex($e.principal.process.file.full_path, `(?i)(esentutl|ntdsutil)\.exe$`) and
re.regex($e.target.process.command_line, `(?i)(sam|ntds|shadow)`)
)
)
condition:
$e
}Chronicle YARA-L 2.0 rule detecting SAM credential dumping by matching process launch events against known attack patterns including registry hive export via reg.exe, Mimikatz lsadump/sekurlsa commands, VSS shadow copy enumeration, and ESENTUTL/NTDSUTIL misuse against SAM/NTDS targets.
Data Sources
Required Tables
False Positives & Tuning
- System administrators performing authorized registry backup exports using reg.exe save commands as part of documented change management procedures
- Legitimate forensic investigation tools or EDR solutions accessing VSS shadows for telemetry collection during incident response
- Authorized penetration tests or red team exercises using Mimikatz or secretsdump as part of a scoped engagement
Other platforms for T1003.002
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Export SAM and SYSTEM Registry Hives
Expected signal: Sysmon Event ID 1: Process Create with Image=reg.exe, CommandLine containing 'save HKLM\sam'. Sysmon Event ID 11: FileCreate for atomic_sam.hiv and atomic_system.hiv. Security Event ID 4688 for reg.exe process creation.
- Test 2SAM Dump via Mimikatz lsadump::sam (Command Pattern)
Expected signal: Sysmon Event ID 1: Process Create with CommandLine containing 'lsadump::sam'. Sysmon Event ID 10: ProcessAccess if Mimikatz attempts to access lsass.exe. Security Event ID 4688 for mimikatz.exe. Windows Defender may flag this as HackTool:Win32/Mimikatz.
- Test 3Create Volume Shadow Copy for SAM Access
Expected signal: Sysmon Event ID 1: Process Create for vssadmin.exe with CommandLine 'create shadow /for=C:'. System Event Log: Event ID 8193/8194 for Volume Shadow Copy service events. Security Event ID 4688 for vssadmin.exe.
References (5)
- https://attack.mitre.org/techniques/T1003/002/
- https://github.com/Neohapsis/creddump7
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md
- https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-hashes-from-sam-registry
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-sam
Unlock Pro Content
Get the full detection package for T1003.002 including response playbook, investigation guide, and atomic red team tests.