{"id":"6ea858a8-ba71-4a12-b2cc-5d83312404c7","title":"HackTool - Typical HiveNightmare SAM File Export","description":"Detects files written by the different tools that exploit HiveNightmare","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-07-23","modified":"2024-06-27","tags":["attack.credential-access","attack.t1552.001","cve.2021-36934"],"technique_ids":["T1552.001"],"logsource":{"product":"windows","category":"file_event"},"falsepositives":["Files that accidentally contain these strings"],"references":["https://github.com/GossiTheDog/HiveNightmare","https://github.com/FireFart/hivenightmare/","https://github.com/WiredPulse/Invoke-HiveNightmare","https://twitter.com/cube0x0/status/1418920190759378944"],"source_path":"rules/windows/file/file_event/file_event_win_hktl_hivenightmare_file_exports.yml","source_sha256":"b538dbf6c485ce5902aad84e469956568e09df62b92b49152d5bfe8cd41cad01","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_hktl_hivenightmare_file_exports.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: HackTool - Typical HiveNightmare SAM File Export\nid: 6ea858a8-ba71-4a12-b2cc-5d83312404c7\nstatus: test\ndescription: Detects files written by the different tools that exploit HiveNightmare\nreferences:\n    - https://github.com/GossiTheDog/HiveNightmare\n    - https://github.com/FireFart/hivenightmare/\n    - https://github.com/WiredPulse/Invoke-HiveNightmare\n    - https://twitter.com/cube0x0/status/1418920190759378944\nauthor: Florian Roth (Nextron Systems)\ndate: 2021-07-23\nmodified: 2024-06-27\ntags:\n    - attack.credential-access\n    - attack.t1552.001\n    - cve.2021-36934\nlogsource:\n    product: windows\n    category: file_event\ndetection:\n    selection:\n        - TargetFilename|contains:\n              - '\\hive_sam_'  # Go version\n              - '\\SAM-2021-'  # C++ version\n              - '\\SAM-2022-'  # C++ version\n              - '\\SAM-2023-'  # C++ version\n              - '\\SAM-haxx'   # Early C++ versions\n              - '\\Sam.save'   # PowerShell version\n        - TargetFilename: 'C:\\windows\\temp\\sam'  # C# version of HiveNightmare\n    condition: selection\nfalsepositives:\n    - Files that accidentally contain these strings\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1552.001","id":"T1552.001","name":"Credentials In Files","page":"techniques/enterprise/T1552.001/"}],"data_path":"data/detection-rules/6ea858a8-ba71-4a12-b2cc-5d83312404c7.json","kind":"sigma"}