|T1003.002||Security Account Manager|
|T1003.005||Cached Domain Credentials|
|T1003.008||/etc/passwd and /etc/shadow|
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the
net user command. Enumerating the SAM database requires SYSTEM level access.
A number of tools can be used to retrieve the SAM file through in-memory techniques:
Alternatively, the SAM can be extracted from the Registry with Reg:
reg save HKLM\sam sam
reg save HKLM\system system
Creddump7 can then be used to process the SAM database locally to retrieve hashes.
During C0017, APT41 copied the
Cobalt Strike can recover hashed passwords.
CosmicDuke collects Windows account hashes.
Password stealer and NTLM stealer modules in CozyCar harvest stored credentials from the victim, including credentials used as part of Windows NTLM user authentication.
CrackMapExec can dump usernames and hashed passwords from the SAM.
Dragonfly has dropped and executed SecretsDump to dump password hashes.
HOPLIGHT has the capability to harvest credentials and passwords from the SAM database.
IceApple's Credential Dumper module can dump encrypted password hashes from SAM registry keys, including
SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information.
Ke3chang has dumped credentials, including by using gsecdump.
Koadic can gather hashed passwords by dumping SAM/SECURITY hive.
menuPass has used a modified version of pentesting tools wmiexec.vbs and secretsdump.py to dump credentials.
Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the SAM table.
Mivast has the capability to gather NTLM password information.
During Night Dragon, threat actors dumped account hashes using gsecdump.
During Operation CuckooBees, the threat actors leveraged a custom tool to dump OS credentials and used following commands:
Threat Group-3390 actors have used gsecdump to dump credentials. They have also dumped credentials from domain controllers.
Wizard Spider has acquired credentials from the SAM/SECURITY registry hives.
|M1028||Operating System Configuration||
Consider disabling or restricting NTLM.
Ensure that local administrator accounts have complex, unique passwords across all systems on the network.
|M1026||Privileged Account Management||
Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.
Limit credential overlap across accounts and systems by training users and administrators not to use the same password for multiple accounts.
|ID||Data Source||Data Component||Detects|
Monitor executed commands and arguments that may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored.
Monitor for hash dumpers opening the Security Accounts Manager (SAM) on the local file system (
|DS0024||Windows Registry||Windows Registry Key Access||
Monitor for the SAM registry key dump being created to access stored account password hashes. Some hash dumpers will open the local file system as a device and parse to the SAM table to avoid file access defenses. Others will make an in-memory copy of the SAM table before reading hashes. Detection of compromised Valid Accounts in-use by adversaries may help as well.