Applied Cybernetics Group
T1003.002 Security Account Manager
- Technique
T1003.002- Tactics
- Credential Access
- Research, 90 days
- 1
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 28
- Elastic, Splunk
- 19
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1003/002
MITRE description
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the <code>net user</code> command. Enumerating the SAM database requires SYSTEM level access. A number of tools can be used to retrieve the SAM file through in-memory techniques: * pwdumpx.exe * [gsecdump](https://attack.mitre.org/software/S0008) * [Mimikatz](https://attack.mitre.org/software/S0002) * secretsdump.py Alternatively, the SAM can be extracted from the Registry with Reg: * <code>reg save HKLM\sam sam</code> * <code>reg save HKLM\system system</code> Creddump7 can then be used to process the SAM database locally to retrieve hashes.(Citation: GitHub Creddump7) Notes: * RID 500 account is the local, built-in administrator. * RID 501 is the guest account. * User accounts start with a RID of 1,000+.
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-10-21Group-IB: Stray Cat, Open Doors: How k0t Wanders Through the Network Edge
Detection coverage
SigmaHQ community rules
- Antivirus - Password Dumper Signature (core)
- Possible Impacket SecretDump Remote Activity - Zeek (core)
- Transferring Files with Credential Data via Network Shares - Zeek (core)
- Possible Impacket SecretDump Remote Activity (core)
- Credential Dumping Tools Service Execution - Security (core)
- Transferring Files with Credential Data via Network Shares (core)
- VSSAudit Security Event Source Registration (core)
- Critical Hive In Suspicious Location Access Bits Cleared (core)
- Volume Shadow Copy Mount (core)
- Crash Dump Created By Operating System (core)
- Credential Dumping Tools Service Execution - System (core)
- Mimikatz Use (core)
- Cred Dump Tools Dropped Files (core)
- HackTool - QuarksPwDump Dump File (core)
- NTDS.DIT Creation By Uncommon Process (core)
- Potential SAM Database Dump (core)
- HackTool - Credential Dumping Tools Named Pipe Created (core)
- VolumeShadowCopy Symlink Creation Via Mklink (core)
- Copying Sensitive Files with Credential Data (core)
- HackTool - Mimikatz Execution (core)
- HackTool - Pypykatz Credentials Dumping Activity (core)
- HackTool - Quarks PwDump Execution (core)
- PowerShell SAM Copy (core)
- Sensitive File Dump Via Print.EXE (core)
- PUA - Memory Dump Mount Via MemProcFS (core)
Showing 25 of 28 community rules.
the full set is tagged attack.t1003.002 in
SigmaHQ.
Elastic and Splunk rules
- NTDS or SAM Database File Copied (elastic)
- Potential Credential Access via Trusted Developer Utility (elastic)
- Credential Acquisition via Registry Hive Dumping (elastic)
- Potential Invoke-Mimikatz PowerShell Script (elastic)
- Windows Registry File Creation in SMB Share (elastic)
- PowerShell Invoke-NinjaCopy script (elastic)
- Sensitive Registry Hive Access via RegBack (elastic)
- Potential Remote Credential Access via Registry (elastic)
- Suspicious Remote Registry Access via SeBackupPrivilege (elastic)
- Symbolic Link to Shadow Copy Created (elastic)
- NTDS Dump via Wbadmin (elastic)
- Azure AD Privileged Authentication Administrator Role Assigned (splunk)
- Azure AD Privileged Graph API Permission Assigned (splunk)
- O365 Privileged Graph API Permission Assigned (splunk)
- Detect Copy of ShadowCopy with Script Block Logging (splunk)
- Esentutl SAM Copy (splunk)
- SAM Database File Access Attempt (splunk)
- Windows Rapid Authentication On Multiple Hosts (splunk)
- Windows Sensitive Registry Hive Dump Via CommandLine (splunk)