T1003.002 — Security Account Manager

Tactic: Credential Access · Platforms: Windows

Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found…

Sub-technique of OS Credential Dumping (T1003).

Sigma detection rules (1)

T1003.002 OS Credential Dumping: Security Account Manager

title: "T1003.002 OS Credential Dumping: Security Account Manager"
id: a9d970ee-2996-4894-a07a-6e759301f450
description: 'Credential Dumping from SAM via Registry Dump and Local File Access. (Data Component: Windows Registry Key Modification; baseline tier: windows-eventid.) Tune using: CommandLinePattern, TargetFilePath, RegistryPath, TimeWindow, ParentProcessName.'
references:
  - https://attack.mitre.org/techniques/T1003/002
author: Shahrukh Khan
date: 2026-02-25
license: MIT
tags:
  - attack.credential-access
  - attack.t1003.002

logsource:
  category: process_creation
  product: windows

detection:
  selection_regsave:
    Image|endswith: '\reg.exe'
    CommandLine|contains: 'save'

  selection_hive:
    CommandLine|contains:
      - 'hklm\sam'
      - 'hklm\security'
      - 'hklm\system'

  condition: selection_regsave and selection_hive

falsepositives:
  - Legitimate registry backup or migration scripts using reg.exe save against SAM/SECURITY/SYSTEM hives.

level: high

Related sub-techniques

Explore