Security Account Manager
Where this stands
One published detection covers this technique. Every one is unverified — no rule on Siemphony has been executed against real telemetry.
What the technique is
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the net user command. Enumerating the SAM database requires SYSTEM level access. A number of tools can be used to retrieve the SAM file through in-memory techniques: pwdumpx.exe gsecdump Mimikatz secretsdump.py Alternatively, the SAM can be extracted from the Registry with Reg: reg save HKLM\sam sam reg save HKLM\system system Creddump7 can then be used to process the SAM database locally to retrieve hashes. Notes: RID 500 account is the local, built-in administrator. RID 501 is the guest account. User accounts start with a RID of 1,000+.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN0235
An adversary running with SYSTEM-level privileges executes commands or accesses registry keys to dump the SAM hive or directly reads sensitive local files from the config directory. This behavior often involves sequential access to HKLM\SAM, HKLM\SYSTEM, and creation of.save or.dmp files, enabling offline hash extraction.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.