T1003.002Credential Access
Security Account Manager
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the net user command. Enumerating the SAM database requires SYSTEM level access. A number of…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
28 Sigma rules tagged T1003.002Security Account ManagerT1003.00228 general rules
- Antivirus - Password Dumper Signaturecriticalstable
- HackTool - Credential Dumping Tools Named Pipe Createdcriticaltest
- HackTool - QuarksPwDump Dump Filecriticaltest
- VolumeShadowCopy Symlink Creation Via Mklinkhighstable
- Copying Sensitive Files with Credential Datahightest
- Cred Dump Tools Dropped Fileshightest
- Credential Dumping Tools Service Execution - Securityhightest
- Credential Dumping Tools Service Execution - Systemhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Security Account Manager
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.