1. Home
  2. ATT&CK Techniques
  3. T1003.002 Security Account Manager

T1003.002 Security Account Manager Mappings

Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the <code>net user</code> command. Enumerating the SAM database requires SYSTEM level access.

A number of tools can be used to retrieve the SAM file through in-memory techniques:

Alternatively, the SAM can be extracted from the Registry with Reg:

  • <code>reg save HKLM\sam sam</code>
  • <code>reg save HKLM\system system</code>

Creddump7 can then be used to process the SAM database locally to retrieve hashes.(Citation: GitHub Creddump7)

Notes:

  • RID 500 account is the local, built-in administrator.
  • RID 501 is the guest account.
  • User accounts start with a RID of 1,000+.
View in MITRE ATT&CK®

Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
AC-2 Account Management Protects T1003.002 Security Account Manager
AC-3 Access Enforcement Protects T1003.002 Security Account Manager
AC-5 Separation of Duties Protects T1003.002 Security Account Manager
AC-6 Least Privilege Protects T1003.002 Security Account Manager
CA-7 Continuous Monitoring Protects T1003.002 Security Account Manager
CM-2 Baseline Configuration Protects T1003.002 Security Account Manager
CM-5 Access Restrictions for Change Protects T1003.002 Security Account Manager
CM-6 Configuration Settings Protects T1003.002 Security Account Manager
CM-7 Least Functionality Protects T1003.002 Security Account Manager
IA-2 Identification and Authentication (organizational Users) Protects T1003.002 Security Account Manager
IA-5 Authenticator Management Protects T1003.002 Security Account Manager
SC-28 Protection of Information at Rest Protects T1003.002 Security Account Manager
SC-39 Process Isolation Protects T1003.002 Security Account Manager
SI-3 Malicious Code Protection Protects T1003.002 Security Account Manager
SI-4 System Monitoring Protects T1003.002 Security Account Manager
action.malware.variety.Capture stored data Capture data stored on system disk related-to T1003.002 OS Credential Dumping: Security Account Manager
action.malware.variety.Password dumper Password dumper (extract credential hashes) related-to T1003.002 OS Credential Dumping: Security Account Manager
action.malware.variety.RAM scraper RAM scraper or memory parser (capture data from volatile memory) related-to T1003.002 OS Credential Dumping: Security Account Manager
attribute.confidentiality.data_disclosure related-to T1003.002 OS Credential Dumping: Security Account Manager