Techniques › T1003 › T1003.002
T1003.002 Security Account Manager
credential access — Windows · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
28
Sigma rules tagged attack.t1003.002
0
KEV CVEs mapped here
<p>Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the <code>net user</code> command. Enumerating the SAM database requires SYSTEM level access.</p><p>A number of tools can be used to retrieve the SAM file through in-memory techniques:</p><p>Alternatively, the SAM can be extracted from the Registry with Reg:</p>
- <li><code>reg save HKLM\sam sam</code></li><li><code>reg save HKLM\system system</code></li>
- <li>RID 500 account is the local, built-in administrator.</li><li>RID 501 is the guest account.</li><li>User accounts start with a RID of 1,000+.</li>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0085 Credential Dumping from SAM via Registry Dump and Local File Access v1.0
AN0235 WindowsAn adversary running with SYSTEM-level privileges executes commands or accesses registry keys to dump the SAM hive or directly reads sensitive local files from the config directory. This behavior often involves sequential access to HKLM\SAM, HKLM\SYSTEM, and creation of .save or .dmp files, enabling offline hash extraction.Tunable:
CommandLinePatternTargetFilePathRegistryPathTimeWindowParentProcessName
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1003.002
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-09-05 (modified 2023-02-05) · logsource: product=windows category=process_creation · 0685b176-c816-4837-8e7b-1216f346636b
Detects usage of the Quarks PwDump tool via commandline arguments
Author: Florian Roth (Nextron Systems), David ANDRE (additional keywords)
· 2017-01-10 (modified 2022-01-05) · logsource: product=windows · 06d71506-7beb-4f22-8888-e2e5e2ca7fd8
This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-01-11 (modified 2022-07-14) · logsource: product=windows category=file_event · 11b1ed55-154d-4e82-8ad7-83739298f720
Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon process or a process located in a suspicious directory
Author: Florian Roth (Nextron Systems)
· 2021-07-29 (modified 2023-01-06) · logsource: product=windows category=process_creation · 1af57a4b-460a-4738-9034-db68b880c665
Detects suspicious PowerShell scripts accessing SAM hives
Author: Samir Bousseaden, wagga
· 2019-04-03 (modified 2022-08-11) · logsource: product=windows service=security · 252902e3-5830-4cf6-bf21-c22083dfd5cf
Detect AD credential dumping using impacket secretdump HKTL
Author: @neu5ron, Teymur Kheirkhabarov, oscd.community
· 2020-04-02 (modified 2021-11-27) · logsource: product=zeek service=smb_files · 2e69f167-47b5-4ae7-a390-47764529eff5
Transferring files with well-known filenames (sensitive files with credential data) using network shares
Author: Ayush Anand (Securityinbits)
· 2026-04-28 · logsource: product=windows category=process_creation · 2fcda7e2-8c57-4904-86ac-37fc3157e09d
Detects the abuse of the Print.exe utility for credential harvesting which involves using Print.Exe to copy sensitive files such as ntds.dit, SAM, SECURITY, or SYSTEM from the Windows directory in order to extract credentials, locally or remotely.
Author: Florian Roth (Nextron Systems)
· 2017-05-15 (modified 2024-01-18) · logsource: product=windows service=system · 39f919f3-980b-4e6f-a975-8af7e507ef2b
Detects events from the Kernel-General ETW indicating that the access bits of a hive with a system like hive name located in the temp directory have been reset.
This occurs when an application tries to access a hive and the hive has not be recognized since the last 7 days (by default).
Registry hive dumping utilities such as QuarksPwDump were seen emitting this behavior.
Author: Teymur Kheirkhabarov, oscd.community
· 2019-10-22 (modified 2023-03-06) · logsource: product=windows category=process_creation · 40b19fa6-d835-400c-b301-41f3a2baacaf
Shadow Copies storage symbolic link creation using operating systems utilities
Author: Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community
· 2017-03-05 (modified 2022-11-29) · logsource: product=windows service=system · 4976aa50-8f41-45c6-8b15-ab3fc10e79ed
Detects well-known credential dumping tools execution via service execution events
Author: Florian Roth (Nextron Systems)
· 2022-02-11 (modified 2023-01-05) · logsource: product=windows category=file_event · 4e87b8e2-2ee9-4b2a-a715-4727d297ece0
Detects the creation of files that look like exports of the local SAM (Security Account Manager)
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
· 2020-10-20 (modified 2022-12-25) · logsource: product=windows category=registry_event · 5aad0995-46ab-41bd-a9ff-724f41114971
Detects the volume shadow copy service initialization and processing via esentutl. Registry keys such as HKLM\\System\\CurrentControlSet\\Services\\VSS\\Diag\\VolSnap\\Volume are captured.
Author: Florian Roth (Nextron Systems), Arnim Rupp
· 2018-09-09 (modified 2026-06-15) · logsource: category=antivirus · 78cc2dd2-7d20-4d32-93ff-057084c38b93
Detects a highly relevant Antivirus alert that reports password dumpers and stealers.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place and check if passwords need to be reset.
Author: Florian Roth (Nextron Systems)
· 2018-02-10 (modified 2024-06-27) · logsource: product=windows category=file_event · 847def9e-924d-4e90-b7c4-5f581395a2b4
Detects a dump file written by QuarksPwDump password dumper
Author: Jason Mull
· 2025-05-12 · logsource: product=windows service=system · 882fbe50-d8d7-4e29-ae80-0648a8556866
Detects "BugCheck" errors indicating the system rebooted due to a crash, capturing the bugcheck code, dump file path, and report ID.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-27 · logsource: product=windows category=process_creation · 8a1b2c3d-4e5f-6789-abcd-ef1234567890
Detects execution of MemProcFS a memory forensics tool with the '-device' parameter.
MemProcFS mounts physical memory as a virtual file system, allowing direct access to process memory and system structures.
Threat actors were seen abusing this utility to mount memory dumps and then extract sensitive information from processes like LSASS or extract registry hives to obtain credentials, LSA secrets, SAM data, and cached domain credentials.
MemProcFS usage that is not part of authorized forensic analysis should be treated as suspicious and warrants further investigation.
Author: Teymur Kheirkhabarov, oscd.community
· 2019-11-01 (modified 2025-10-25) · logsource: product=windows category=file_event · 8fbf3271-1ef6-4e94-8210-03c2317947f6
Files with well-known filenames (parts of credential dump software or files produced by them) creation
Author: Teymur Kheirkhabarov, oscd.community
· 2019-10-22 (modified 2025-07-11) · logsource: product=windows service=security · 910ab938-668b-401b-b08c-b596e80fdca5
Transferring files with well-known filenames (sensitive files with credential data) using network shares
Author: Samir Bousseaden, @neu5ron
· 2020-03-19 (modified 2021-11-27) · logsource: product=zeek service=smb_files · 92dae1ed-1c9d-4eff-a567-33acbd95b00e
Detect AD credential dumping using impacket secretdump HKTL. Based on the SIGMA rules/windows/builtin/win_impacket_secretdump.yml
Author: Teymur Kheirkhabarov, oscd.community
· 2019-11-01 (modified 2023-08-07) · logsource: product=windows category=pipe_created · 961d0ba2-3eea-4303-a930-2cf78bbfcc5e
Detects well-known credential dumping tools execution via specific named pipe creation
Author: frack113
· 2022-01-05 (modified 2023-02-05) · logsource: product=windows category=process_creation · a29808fd-ef50-49ff-9c7a-59a9b040b404
Detects the usage of "pypykatz" to obtain stored credentials. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database through Windows registry where the SAM database is stored
Author: Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton
· 2019-10-22 (modified 2023-02-21) · logsource: product=windows category=process_creation · a642964e-bead-4bed-8910-1bb4d63e3b4d
Detection well-known mimikatz command line arguments
Author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community
· 2019-10-22 (modified 2022-11-10) · logsource: product=windows category=process_creation · b17ea6f7-6e90-447e-a799-e6c0a493d6ce
Shadow Copies creation using operating systems utilities, possible credential access
Author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community
· 2019-10-22 (modified 2024-06-04) · logsource: product=windows category=process_creation · e7be6119-fc37-43f0-ad4f-1f3f99be2f9f
Files with well-known filenames (sensitive files with credential data) copying
Author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR)
· 2020-10-20 (modified 2022-04-28) · logsource: product=windows service=security · e9faba72-4974-4ab2-a4c5-46e25ad59e9b
Detects the registration of the security event source VSSAudit. It would usually trigger when volume shadow copy operations happen.
Author: Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community
· 2017-03-05 (modified 2022-11-29) · logsource: product=windows service=security · f0d1feba-4344-4ca9-8121-a6c97bd6df52
Detects well-known credential dumping tools execution via service execution events
Author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR)
· 2020-10-20 (modified 2022-12-25) · logsource: product=windows service=system · f512acbf-e662-4903-843e-97ce4652b740
Detects volume shadow copy mount via Windows event log
Author: Teymur Kheirkhabarov, Endgame, JHasenbusch, Daniil Yugoslavskiy, oscd.community, frack113
· 2019-10-22 (modified 2023-12-13) · logsource: product=windows category=process_creation · fd877b94-9bb5-4191-bb25-d79cbd93c167
Detects the usage of "reg.exe" in order to dump sensitive registry hives. This includes SAM, SYSTEM and SECURITY hives.
Rules tagged at the parent level (attack.t1003) 37
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-23 (modified 2023-08-17) · logsource: product=windows category=registry_set · 0442defa-b4a2-41c9-ae2c-ea7042fc4701
Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it
Author: Tim Rauch, Elastic (idea)
· 2022-09-28 · logsource: product=windows category=ps_script · 189e3b02-82b2-4b90-9662-411eb64486d4
Detects Invoke-Mimikatz PowerShell script and alike. Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords.
Author: Thomas Patzke
· 2017-06-14 (modified 2025-01-30) · logsource: product=windows service=security · 1de68c67-af5c-4097-9c85-fe5578e09e67
Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host
Author: Florian Roth (Nextron Systems)
· 2022-03-04 (modified 2024-11-23) · logsource: product=windows category=process_creation · 24e3e58a-646b-4b50-adef-02ef935b9fc8
Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed
Author: Florian Roth (Nextron Systems), David ANDRE (additional keywords)
· 2021-12-20 (modified 2025-10-19) · logsource: product=windows category=process_creation · 2617e7ed-adb7-40ba-b0f3-8f9945fe6c09
Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)
Author: Tim Rauch, Janantha Marasinghe, Elastic (original idea)
· 2022-11-08 (modified 2023-01-22) · logsource: product=windows category=process_creation · 2d3cdeec-c0db-45b4-aa86-082f7eb75701
Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords
Author: Christian Burkard (Nextron Systems), Florian Roth (Nextron Systems)
· 2023-04-27 · logsource: product=windows category=ps_script · 3245cd30-e015-40ff-a31d-5cadd5f377ec
Detects the execution of the hacktool Rubeus using specific command line flags
Author: Milad Cheraghi
· 2026-04-28 · logsource: product=linux category=process_creation · 33b3cfb1-574e-44b9-b527-fbf9303b9d7b
Detects attempts of an attacker to enable core dumps for set-user-ID (SUID) processes by modifying the system file /proc/sys/fs/suid_dumpable, typically by setting its value to 1 or 2.
Enabling this feature allows memory dumps (core dumps) of SUID processes, which usually run with elevated privileges.
These dumps may contain sensitive information such as passwords, cryptographic keys or other secrets.
CVE-2025-5054: Information leak via core dumps from SUID binaries using apport.
CVE-2025-4598: Information disclosure in systemd-coredump due to insecure handling of SUID process memory dumps.
Author: Swachchhanda Shrawan Poudel
· 2024-02-12 (modified 2024-03-13) · logsource: product=windows category=process_creation · 34275eb8-fa19-436b-b959-3d9ecd53fa1f
Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe".
This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question.
In order to dump the process memory or perform other nefarious actions.
Author: Florian Roth (Nextron Systems)
· 2022-04-27 (modified 2024-01-15) · logsource: product=windows category=process_creation · 37c1333a-a0db-48be-b64b-7393b2386e3b
Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · 3ec9a16d-0b4f-4967-9542-ebf38ceac7dd
Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using SQLAuth.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-10-11 (modified 2026-07-28) · logsource: product=windows category=file_access · 407aecb1-e762-4acf-8c7b-d087bcff3bb6
Detects suspicious processes based on name and location that access the windows credential manager and vault.
Which can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::cred" function
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-27 (modified 2026-01-09) · logsource: product=windows category=image_load · 416bc4a2-7217-4519-8dc7-c3271817f1d5
Detects loading of dbgcore.dll or dbghelp.dll from uncommon locations such as user directories.
These DLLs contain the MiniDumpWriteDump function, which can be abused for credential dumping purposes or in some cases for evading EDR/AV detection by suspending processes.
Author: Pawel Mazur
· 2021-05-24 (modified 2022-12-18) · logsource: product=linux service=auditd · 49aae26c-450e-448b-911d-b3c13d178dfc
Detect attempt to enable auditing of TTY input
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · 547dfc53-ebf6-4afe-8d2e-793d9574975d
Detects instances where a REDIS service on an OpenCanary node has had an action command attempted.
Author: Andreas Braathen (mnemonic.io)
· 2025-10-19 · logsource: product=windows service=security · 5d6c375a-18ae-4952-b4f6-8b803f6c8555
Detects access to Signal Desktop's sensitive data files: db.sqlite and config.json.
The db.sqlite file in Signal Desktop stores all locally saved messages in an encrypted SQLite database, while the config.json contains the decryption key needed to access that data.
Since the key is stored in plain text, a threat actor who gains access to both files can decrypt and read sensitive messages without needing the users credentials.
Currently the rule only covers the default Signal installation path in AppData\Roaming. Signal Portable installations may use different paths based on user configuration. Additional paths can be added to the selection as needed.
HackTool - Potential Remote Credential Dumping Activity Via CrackMapExec Or Impacket-Secretsdump
hightest
Author: SecurityAura
· 2022-11-16 (modified 2024-06-27) · logsource: product=windows category=file_event · 6e2a900a-ced9-4e4a-a9c2-13e706f9518a
Detects default filenames output from the execution of CrackMapExec and Impacket-secretsdump against an endpoint.
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · 6e78f90f-0043-4a01-ac41-f97681613a66
Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using Windows Authentication.
Author: Florian Roth (Nextron Systems), Arnim Rupp
· 2018-09-09 (modified 2026-06-15) · logsource: category=antivirus · 78cc2dd2-7d20-4d32-93ff-057084c38b93
Detects a highly relevant Antivirus alert that reports password dumpers and stealers.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place and check if passwords need to be reset.
Author: sam0x90
· 2021-08-06 (modified 2022-10-09) · logsource: product=windows category=process_creation · 7df1713a-1a5b-4a4b-a071-dc83b144a101
Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to get MSEdge info via its module pwgrab.
Author: Florian Roth (Nextron Systems)
· 2018-12-19 (modified 2023-04-20) · logsource: product=windows category=process_creation · 7ec2c172-dceb-4c10-92c9-87c1881b7e18
Detects the execution of the hacktool Rubeus via PE information of command line parameters
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-27 · logsource: product=windows category=process_creation · 8a1b2c3d-4e5f-6789-abcd-ef1234567890
Detects execution of MemProcFS a memory forensics tool with the '-device' parameter.
MemProcFS mounts physical memory as a virtual file system, allowing direct access to process memory and system structures.
Threat actors were seen abusing this utility to mount memory dumps and then extract sensitive information from processes like LSASS or extract registry hives to obtain credentials, LSA secrets, SAM data, and cached domain credentials.
MemProcFS usage that is not part of authorized forensic analysis should be treated as suspicious and warrants further investigation.
Author: frack113, X__Junior (Nextron Systems)
· 2022-04-09 (modified 2024-07-29) · logsource: product=windows category=file_access · 91cb43db-302a-47e3-b3c8-7ede481e27bf
Detects file access requests to browser credential stores by uncommon processes.
Could indicate potential attempt of credential stealing.
Requires heavy baselining before usage
Author: Julia Fomina, oscd.community
· 2020-10-09 (modified 2025-10-31) · logsource: product=windows category=process_creation · 93671f99-04eb-4ab4-a161-70d446a84003
Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process.
Author: Tim Rauch, Elastic (idea)
· 2022-09-28 (modified 2022-12-30) · logsource: product=windows category=process_creation · 97dbf6e2-e436-44d8-abee-4261b24d3e41
Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-07-23 · logsource: product=windows category=file_event · a7f3c891-2e4d-4b6a-9f8c-d5e2a1b04c73
Detects the creation of a registry hive file (UsrClass.dat or NTUSER.DAT) outside of the standard user profile path.
These files generally contain various user-specific registry settings and are typically located in the user's profile directory.
Staging these files outside of the standard path can be indicative of an attacker attempting to manipulate user registry settings
for persistence, privilege escalation, or dump user registry hives for credential harvesting.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-10-21 · logsource: product=aws service=cloudtrail · a840e606-7c8c-4684-9bc1-eb6b6155127f
Detects the execution of TruffleHog, a popular open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment.
It has been reported to be used by threat actors for credential harvesting. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious.
Author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community
· 2019-10-22 (modified 2022-11-10) · logsource: product=windows category=process_creation · b17ea6f7-6e90-447e-a799-e6c0a493d6ce
Shadow Copies creation using operating systems utilities, possible credential access
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-23 (modified 2023-02-02) · logsource: product=windows category=process_creation · baef1ec6-2ca9-47a3-97cc-4cf2bda10b77
Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it
Author: sawwinnnaung
· 2020-05-07 (modified 2023-10-11) · logsource: product=azure service=activitylogs · c1182e02-49a3-481c-b3de-0fadc4091488
Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.
Author: X__Junior (Nextron Systems)
· 2024-07-29 · logsource: product=windows category=file_access · c5f37810-a85f-4186-81e9-33f23abb4141
Detects file access requests to chromium based browser sensitive files by uncommon processes.
Could indicate potential attempt of stealing sensitive information.
Author: Florian Roth (Nextron Systems), Samir Bousseaden
· 2021-11-27 (modified 2023-03-02) · logsource: product=windows category=process_creation · c8da0dfd-4ed0-4b68-962d-13c9c884384e
Detects a suspicious LSASS process process clone that could be a sign of credential dumping activity
Author: Max Altgelt (Nextron Systems)
· 2021-09-21 (modified 2022-12-25) · logsource: product=windows category=ps_script · cd185561-4760-45d6-a63e-a51325112cae
Detects usage of a PowerShell command to dump the live memory of a Windows machine
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-05-23 (modified 2023-08-17) · logsource: product=windows category=registry_set · e4d22291-f3d5-4b78-9a0c-a1fbaf32a6a4
Detects the registration of a new ODBC driver where the driver is located in a potentially suspicious location
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · e7d79a1b-25ed-4956-bd56-bd344fa8fd06
Detects instances where a MySQL service on an OpenCanary node has had a login attempt.
Author: Swachchhanda Shrawan Poudel
· 2024-02-12 · logsource: product=windows category=process_creation · e83e8899-c9b2-483b-b355-5decc942b959
Detects the enumeration and query of interesting and in some cases sensitive services on the system via "sc.exe".
Attackers often try to enumerate the services currently running on a system in order to find different attack vectors.
Author: X__Junior (Nextron Systems)
· 2024-07-29 · logsource: product=windows category=file_access · f41b0311-44f9-44f0-816d-dd45e39d4bc8
Detects file access requests to crypto currency files by uncommon processes.
Could indicate potential attempt of crypto currency wallet stealing.