Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the <code>net user</code> command. Enumerating the SAM database requires SYSTEM level access.
A number of tools can be used to retrieve the SAM file through in-memory techniques:
Alternatively, the SAM can be extracted from the Registry with Reg:
Creddump7 can then be used to process the SAM database locally to retrieve hashes.(Citation: GitHub Creddump7)
Notes:
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| intel-tdt | Intel Threat Detection Technology | CrowdStrike AMS | T1003.002 | Security Account Manager |
Comments
Intel Threat Detection Technology (TDT), combined with CrowdStrike Falcon Accelerated Memory Scanning (CAMS), enhances cybersecurity defenses by enabling faster, real-time detection of Security Account Manager (SAM) Credential Dumping exploits. This integrated solution strengthens CrowdStrike Falcon, improving its ability to detect and mitigate cyber threats earlier in the kill chain, all while minimizing system performance impact.
SAM Credential Dumping attacks involve adversaries targeting the Security Account Manager (SAM) database, which stores user account information and password hashes. Attackers use tools and techniques to dump this sensitive data from the system’s memory, enabling them to extract account credentials, escalate privileges, or move laterally within the network. Intel TDT plays a critical role in identifying these threats by providing real-time telemetry on program execution, memory access, and control flow, allowing the detection of abnormal behaviors that signal unauthorized access to the SAM or attempts to extract user credentials from the system.
Additionally, CAMS offloads the memory scanning workload from the CPU to the Intel Integrated GPU, enabling faster, more efficient detection of malicious activity without impacting system performance. CAMS helps identify suspicious behaviors, such as unauthorized access to the SAM database or credential dumping attempts, providing proactive defense against these stealthy techniques used by attackers to gain access to critical systems.
References
|