T1003.002sub-technique of T1003 OS Credential Dumping
Security Account Manager
Windowsnothing on this site yetT1003.002 on attack.mitre.org
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the `net user` command. Enumerating the SAM database requires SYSTEM level access.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
how MITRE says to see it
Credential Dumping from SAM via Registry Dump and Local File Access
- An adversary running with SYSTEM-level privileges executes commands or accesses registry keys to dump the SAM hive or directly reads sensitive local files from the config directory.
what reduces it
- M1017 User Training. Limit credential overlap across accounts and systems by training users and administrators not to use the same password for multiple accounts.
- M1028 Operating System Configuration. Consider disabling or restricting NTLM.
- M1027 Password Policies. Ensure that local administrator accounts have complex, unique passwords across all systems on the network.
- M1026 Privileged Account Management. Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.