Skip to content

T1003.002 Security Account Manager

Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the net user command. Enumerating the SAM database requires SYSTEM level access.

A number of tools can be used to retrieve the SAM file through in-memory techniques:

Alternatively, the SAM can be extracted from the Registry with Reg:

  • reg save HKLM\sam sam
  • reg save HKLM\system system

Creddump7 can then be used to process the SAM database locally to retrieve hashes.1

Notes:

  • RID 500 account is the local, built-in administrator.
  • RID 501 is the guest account.
  • User accounts start with a RID of 1,000+.
Item Value
ID T1003.002
Sub-techniques T1003.001, T1003.002, T1003.003, T1003.004, T1003.005, T1003.006, T1003.007, T1003.008
Tactics TA0006
Platforms Windows
Version 1.1
Created 11 February 2020
Last Modified 24 October 2025

Procedure Examples

ID Name Description
G1030 Agrius Agrius dumped the SAM file on victim machines to capture credentials.28
C0051 APT28 Nearest Neighbor Campaign During APT28 Nearest Neighbor Campaign, APT28 used the following commands to dump SAM, SYSTEM, and SECURITY hives: reg save hklm\sam, reg save hklm\system, and reg save hklm\security.41
G0016 APT29 APT29 has used the reg save command to save registry hives.23
G0096 APT41 APT41 extracted user account data from the Security Account Managerr (SAM), making a copy of this database from the registry using the reg save command or by exploiting volume shadow copies.29
G1023 APT5 APT5 has copied and exfiltrated the SAM Registry hive from targeted systems.30
C0017 C0017 During C0017, APT41 copied the SAM and SYSTEM Registry hives for credential harvesting.39
S0154 Cobalt Strike Cobalt Strike can recover hashed passwords.19
S0050 CosmicDuke CosmicDuke collects Windows account hashes.18
S0046 CozyCar Password stealer and NTLM stealer modules in CozyCar harvest stored credentials from the victim, including credentials used as part of Windows NTLM user authentication.15
S0488 CrackMapExec CrackMapExec can dump usernames and hashed passwords from the SAM.3
G1034 Daggerfly Daggerfly used Reg to dump the Security Account Manager (SAM) hive from victim machines for follow-on credential extraction.21
G0035 Dragonfly Dragonfly has dropped and executed SecretsDump to dump password hashes.25
G1003 Ember Bear Ember Bear acquires victim credentials by extracting registry hives such as the Security Account Manager through commands such as reg save.3637
S0120 Fgdump Fgdump can dump Windows password hashes.12
G1016 FIN13 FIN13 has extracted the SAM and SYSTEM registry hives using the reg.exe binary for obtaining password hashes from a compromised machine.24
C0041 FrostyGoop Incident During FrostyGoop Incident, the adversary retrieved the contents of the Security Account Manager (SAM) hive in the victim environment for credential capture.38
G0093 GALLIUM GALLIUM used reg commands to dump specific hives from the Windows Registry, such as the SAM hive, and obtain password hashes.22
S0008 gsecdump gsecdump can dump Windows password hashes from the SAM.4
S0376 HOPLIGHT HOPLIGHT has the capability to harvest credentials and passwords from the SAM database.13
S1022 IceApple IceApple’s Credential Dumper module can dump encrypted password hashes from SAM registry keys, including HKLM\SAM\SAM\Domains\Account\F and HKLM\SAM\SAM\Domains\Account\Users\*\V.20
S0357 Impacket SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information.11
G0004 Ke3chang Ke3chang has dumped credentials, including by using gsecdump.2627
S0250 Koadic Koadic can gather hashed passwords by dumping SAM/SECURITY hive.5
G0045 menuPass menuPass has used a modified version of pentesting tools wmiexec.vbs and secretsdump.py to dump credentials.3132
S0002 Mimikatz Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the SAM table.78910
S0080 Mivast Mivast has the capability to gather NTLM password information.16
C0002 Night Dragon During Night Dragon, threat actors dumped account hashes using gsecdump.40
C0012 Operation CuckooBees During Operation CuckooBees, the threat actors leveraged a custom tool to dump OS credentials and used following commands: reg save HKLM\\SYSTEM system.hiv, reg save HKLM\\SAM sam.hiv, and reg save HKLM\\SECURITY security.hiv, to dump SAM, SYSTEM and SECURITY hives.42
S0371 POWERTON POWERTON has the ability to dump password hashes.17
S0006 pwdump pwdump can be used to dump credentials from the SAM.6
S0125 Remsec Remsec can dump the SAM database.14
G0027 Threat Group-3390 Threat Group-3390 actors have used gsecdump to dump credentials. They have also dumped credentials from domain controllers.3334
G0102 Wizard Spider Wizard Spider has acquired credentials from the SAM/SECURITY registry hives.35

Mitigations

ID Mitigation Description
M1028 Operating System Configuration Consider disabling or restricting NTLM.2
M1027 Password Policies Ensure that local administrator accounts have complex, unique passwords across all systems on the network.
M1026 Privileged Account Management Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.
M1017 User Training Limit credential overlap across accounts and systems by training users and administrators not to use the same password for multiple accounts.

References

  1. Flathers, R. (2018, February 19). creddump7. Retrieved April 11, 2018. ↩

  2. Microsoft. (2012, November 29). Using security policies to restrict NTLM traffic. Retrieved December 4, 2017. ↩

  3. byt3bl33d3r. (2018, September 8). SMB: Command Reference. Retrieved July 17, 2020. ↩

  4. Vincent Tiu. (2017, September 15). HackTool:Win32/Gsecdump. Retrieved January 10, 2024. ↩

  5. Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024. ↩

  6. Wikipedia. (2007, August 9). pwdump. Retrieved June 22, 2016. ↩

  7. Deply, B. (n.d.). Mimikatz. Retrieved September 29, 2015. ↩

  8. Deply, B., Le Toux, V. (2016, June 5). module ~ lsadump. Retrieved August 7, 2017. ↩

  9. Grafnetter, M. (2015, October 26). Retrieving DPAPI Backup Keys from Active Directory. Retrieved December 19, 2017. ↩

  10. The Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the New Zealand National Cyber Security Centre (NZ NCSC), CERT New Zealand, the UK National Cyber Security Centre (UK NCSC) and the US National Cybersecurity and Communications Integration Center (NCCIC). (2018, October 11). Joint report on publicly available hacking tools. Retrieved March 11, 2019. ↩

  11. SecureAuth. (n.d.). Retrieved January 15, 2019. ↩

  12. Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016. ↩

  13. US-CERT. (2019, April 10). MAR-10135536-8 – North Korean Trojan: HOPLIGHT. Retrieved April 19, 2019. ↩

  14. Kaspersky Lab’s Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016. ↩

  15. F-Secure Labs. (2015, April 22). CozyDuke: Malware Analysis. Retrieved December 10, 2015. ↩

  16. Stama, D.. (2015, February 6). Backdoor.Mivast. Retrieved February 15, 2016. ↩

  17. Ackerman, G., et al. (2018, December 21). OVERRULED: Containing a Potentially Destructive Adversary. Retrieved January 17, 2019. ↩

  18. F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015. ↩

  19. Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual. Retrieved May 24, 2017. ↩

  20. CrowdStrike. (2022, May). ICEAPPLE: A NOVEL INTERNET INFORMATION SERVICES (IIS) POST-EXPLOITATION FRAMEWORK. Retrieved June 27, 2022. ↩

  21. Threat Hunter Team. (2023, April 20). Daggerfly: APT Actor Targets Telecoms Company in Africa. Retrieved July 25, 2024. ↩

  22. Cybereason Nocturnus. (2019, June 25). Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers. Retrieved July 18, 2019. ↩

  23. Mandiant. (2022, May 2). UNC3524: Eye Spy on Your Email. Retrieved August 17, 2023. ↩

  24. Sygnia Incident Response Team. (2022, January 5). TG2003: ELEPHANT BEETLE UNCOVERING AN ORGANIZED FINANCIAL-THEFT OPERATION. Retrieved February 9, 2023. ↩

  25. US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018. ↩

  26. Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014. ↩

  27. Smallridge, R. (2018, March 10). APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS. Retrieved April 4, 2018. ↩

  28. Or Chechik, Tom Fakterman, Daniel Frank & Assaf Dahan. (2023, November 6). Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors. Retrieved May 22, 2024. ↩

  29. Nikita Rostovcev. (2022, August 18). APT41 World Tour 2021 on a tight schedule. Retrieved February 22, 2024. ↩

  30. Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024. ↩

  31. PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017. ↩

  32. Twi1ight. (2015, July 11). AD-Pentest-Script - wmiexec.vbs. Retrieved June 29, 2017. ↩

  33. Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, August 5). Threat Group-3390 Targets Organizations for Cyberespionage. Retrieved August 18, 2018. ↩

  34. Counter Threat Unit Research Team. (2017, June 27). BRONZE UNION Cyberespionage Persists Despite Disclosures. Retrieved July 13, 2017. ↩

  35. Kimberly Goody, Jeremy Kennelly, Joshua Shilko, Steve Elovitz, Douglas Bienstock. (2020, October 28). Unhappy Hour Special: KEGTAP and SINGLEMALT With a Ransomware Chaser. Retrieved October 28, 2020. ↩

  36. Microsoft Threat Intelligence. (2023, June 14). Cadet Blizzard emerges as a novel and distinct Russian threat actor. Retrieved July 10, 2023. ↩

  37. US Cybersecurity & Infrastructure Security Agency et al. (2024, September 5). Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure. Retrieved September 6, 2024. ↩

  38. Mark Graham, Carolyn Ahlers, Kyle O’Meara; Dragos. (2024, July). Impact of FrostyGoop ICS Malware on Connected OT Systems. Retrieved November 20, 2024. ↩

  39. Rufus Brown, Van Ta, Douglas Bienstock, Geoff Ackerman, John Wolfram. (2022, March 8). Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments. Retrieved July 8, 2022. ↩

  40. McAfee® Foundstone® Professional Services and McAfee Labs™. (2011, February 10). Global Energy Cyberattacks: “Night Dragon”. Retrieved February 19, 2018. ↩

  41. Koessel, Sean. Adair, Steven. Lancaster, Tom. (2024, November 22). The Nearest Neighbor Attack: How A Russian APT Weaponized Nearby Wi-Fi Networks for Covert Access. Retrieved February 25, 2025. ↩

  42. Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022. ↩