{"id":"4e87b8e2-2ee9-4b2a-a715-4727d297ece0","title":"Potential SAM Database Dump","description":"Detects the creation of files that look like exports of the local SAM (Security Account Manager)","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-02-11","modified":"2023-01-05","tags":["attack.credential-access","attack.t1003.002"],"technique_ids":["T1003.002"],"logsource":{"product":"windows","category":"file_event"},"falsepositives":["Rare cases of administrative activity"],"references":["https://github.com/search?q=CVE-2021-36934","https://web.archive.org/web/20210725081645/https://github.com/cube0x0/CVE-2021-36934","https://www.google.com/search?q=%22reg.exe+save%22+sam","https://github.com/HuskyHacks/ShadowSteal","https://github.com/FireFart/hivenightmare"],"source_path":"rules/windows/file/file_event/file_event_win_sam_dump.yml","source_sha256":"bf6eb68d113c3a0caf1516cdb6055d5a32f441c5a8e7e52f7cd9ee54655b18fa","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_sam_dump.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential SAM Database Dump\nid: 4e87b8e2-2ee9-4b2a-a715-4727d297ece0\nstatus: test\ndescription: Detects the creation of files that look like exports of the local SAM (Security Account Manager)\nreferences:\n    - https://github.com/search?q=CVE-2021-36934\n    - https://web.archive.org/web/20210725081645/https://github.com/cube0x0/CVE-2021-36934\n    - https://www.google.com/search?q=%22reg.exe+save%22+sam\n    - https://github.com/HuskyHacks/ShadowSteal\n    - https://github.com/FireFart/hivenightmare\nauthor: Florian Roth (Nextron Systems)\ndate: 2022-02-11\nmodified: 2023-01-05\ntags:\n    - attack.credential-access\n    - attack.t1003.002\nlogsource:\n    product: windows\n    category: file_event\ndetection:\n    selection:\n        - TargetFilename|endswith:\n              - '\\Temp\\sam'\n              - '\\sam.sav'\n              - '\\Intel\\sam'\n              - '\\sam.hive'\n              - '\\Perflogs\\sam'\n              - '\\ProgramData\\sam'\n              - '\\Users\\Public\\sam'\n              - '\\AppData\\Local\\sam'\n              - '\\AppData\\Roaming\\sam'\n              - '_ShadowSteal.zip'       # https://github.com/HuskyHacks/ShadowSteal\n              - '\\Documents\\SAM.export'  # https://github.com/n3tsurge/CVE-2021-36934/\n              - ':\\sam'\n        - TargetFilename|contains:\n              - '\\hive_sam_'             # https://github.com/FireFart/hivenightmare\n              - '\\sam.save'\n              - '\\sam.export'\n              - '\\~reg_sam.save'\n              - '\\sam_backup'\n              - '\\sam.bck'\n              - '\\sam.backup'\n    condition: selection\nfalsepositives:\n    - Rare cases of administrative activity\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003.002","id":"T1003.002","name":"Security Account Manager","page":"techniques/enterprise/T1003.002/"}],"data_path":"data/detection-rules/4e87b8e2-2ee9-4b2a-a715-4727d297ece0.json","kind":"sigma"}