t1003-002-security-account-manager

name	T1003.002_security-account-manager
description	Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is...
category	authentication
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1003.002","credential-access","windows","sub-technique"]
technique_id	T1003.002
tactic	credential-access
all_tactics	["credential-access"]
platforms	["Windows"]
mitre_url	https://attack.mitre.org/techniques/T1003/002
tech_stack	["windows"]
cwe_ids	["CWE-522"]
chains_with	["T1003","T1003.001","T1003.003","T1003.004","T1003.005","T1003.006","T1003.007","T1003.008"]
prerequisites	["T1003"]
severity_boost	{"T1003":"Chain with T1003 for deeper attack path","T1003.001":"Chain with T1003.001 for deeper attack path","T1003.003":"Chain with T1003.003 for deeper attack path"}

T1003.002 Security Account Manager

Sub-technique of: T1003

High-Level Description

Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the net user command. Enumerating the SAM database requires SYSTEM level access.

A number of tools can be used to retrieve the SAM file through in-memory techniques:

• pwdumpx.exe
• gsecdump
• Mimikatz
• secretsdump.py

Alternatively, the SAM can be extracted from the Registry with Reg:

• reg save HKLM\sam sam
• reg save HKLM\system system

Creddump7 can then be used to process the SAM database locally to retrieve hashes.

Notes:

• RID 500 account is the local, built-in administrator.
• RID 501 is the guest account.
• User accounts start with a RID of 1,000+.

Kill Chain Phase

• Credential Access (TA0006)

Platforms: Windows

What to Check

• Identify if Security Account Manager technique is applicable to target environment
• Check Windows systems for indicators of Security Account Manager
• Verify mitigations are bypassed or absent (4 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Registry dump of SAM, creds, and secrets

Local SAM (SAM & System), cached credentials (System & Security) and LSA secrets (System & Security) can be enumerated via three registry keys. Then processed locally using https://github.com/Neohapsis/creddump7

Upon successful execution of this test, you will find three files named, sam, system and security in the %temp% directory.

Supported Platforms: windows Yes