name: Potential SAM hive dumping
id: 2f326557-0291-4eb1-a87a-7a17b7d941cb
version: 1.0.0
description:
  Identifies access to the Security Account Manager registry hives.
labels:
  tactic.id: TA0006
  tactic.name: Credential Access
  tactic.ref: https://attack.mitre.org/tactics/TA0006/
  technique.id: T1003
  technique.name: OS Credential Dumping
  technique.ref: https://attack.mitre.org/techniques/T1003/
  subtechnique.id: T1003.002
  subtechnique.name: Security Account Manager
  subtechnique.ref: https://attack.mitre.org/techniques/T1003/002/
references:
  - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-hashes-from-sam-registry

condition: >
  sequence
  maxspan 10m
    |spawn_process and not (ps.exe imatches
      (
        '?:\\Program Files\\*.exe',
        '?:\\Program Files (x86)\\*.exe'
      )
        or
      (ps.exe imatches 'C:\\Windows\\System32\\svchost.exe' and ps.args iin ('-k', 'DcomLaunch'))
     )
    | by ps.child.uuid
    |open_registry
      and
     registry.key.name imatches 'HKEY_LOCAL_MACHINE\\SAM\\SAM\\Domains\\Account\\*'
      and
      not
     registry.key.name imatches
      (
        'HKEY_LOCAL_MACHINE\\SAM\\SAM\\Domains\\Account\\Users',
        'HKEY_LOCAL_MACHINE\\SAM\\SAM\\Domains\\Account\\Users\\Names',
        'HKEY_LOCAL_MACHINE\\SAM\\SAM\\Domains\\Account',
        'HKEY_LOCAL_MACHINE\\SAM\\SAM\\Account\\Aliases\\*'
      )
      and
      not
     ps.exe imatches
      (
        '?:\\Windows\\System32\\lsass.exe',
        '?:\\Windows\\System32\\RuntimeBroker.exe',
        '?:\\Windows\\explorer.exe',
        '?:\\Windows\\System32\\Taskmgr.exe',
        '?:\\Windows\\System32\\sihost.exe',
        '?:\\Windows\\System32\\SearchIndexer.exe',
        '?:\\Windows\\System32\\SearchProtocolHost.exe',
        '?:\\Windows\\System32\\svchost.exe',
        '?:\\Windows\\System32\\services.exe',
        '?:\\Windows\\System32\\taskhostw.exe',
        '?:\\Windows\\System32\\backgroundTaskHost.exe',
        '?:\\Windows\\System32\\WerFault.exe',
        '?:\\Windows\\System32\\ctfmon.exe',
        '?:\\Windows\\System32\\Wbem\\WmiPrvSE.exe',
        '?:\\Windows\\System32\\CompatTelRunner.exe',
        '?:\\Windows\\System32\\cleanmgr.exe',
        '?:\\Windows\\System32\\MoUsoCoreWorker.exe',
        '?:\\Windows\\System32\\lpremove.exe',
        '?:\\Windows\\System32\\LogonUI.exe',
        '?:\\ProgramData\\Microsoft\\Windows Defender\\*\\MsMpEng.exe',
        '?:\\Windows\\System32\\ApplicationFrameHost.exe'
       )
      | by ps.uuid

min-engine-version: 2.0.0
