CmdID

CmdID / Techniques / T1003

T1003.002 OS Credential Dumping: Security Account Manager

Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. MITRE ATT&CK

2 programs on CmdID 10 Sigma rules T1003.002 on attack.mitre.org

Part of

MITRE ATT&CK
T1003OS Credential Dumping

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules
print.exeits Sigma rulesreg.exeCredentials

Sigma rules tagged with it

process creation, the highest levels first
highCopying Sensitive Files with Credential DataTeymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community · Windows
highDumping of Sensitive Hives Via Reg.EXETeymur Kheirkhabarov, Endgame, JHasenbusch, Daniil Yugoslavskiy, oscd.community, frack113 · Windows
highHackTool - Mimikatz ExecutionTeymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton · Windows
highHackTool - Pypykatz Credentials Dumping Activityfrack113 · Windows
highHackTool - Quarks PwDump ExecutionNasreddine Bencherchali (Nextron Systems) · Windows
highPowerShell SAM CopyFlorian Roth (Nextron Systems) · Windows
highPUA - Memory Dump Mount Via MemProcFSSwachchhanda Shrawan Poudel (Nextron Systems) · Windows
highSensitive File Dump Via Print.EXEAyush Anand (Securityinbits) · Windows
highVolumeShadowCopy Symlink Creation Via MklinkTeymur Kheirkhabarov, oscd.community · Windows
mediumShadow Copies Creation Using Operating Systems UtilitiesTeymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Run mimikatz in interactive mode on the page for mimikatz

mimikatzIdentify

Enable debug privileges (needed for most operations) on the page for mimikatz

mimikatz "privilege::debug"Identify

Dump plaintext passwords, NTLM hashes, and Kerberos tickets from memory on the page for mimikatz

mimikatz "sekurlsa::logonpasswords"Identify

Pass-the-Hash with a specific NTLM hash and launch a command on the page for mimikatz

mimikatz "sekurlsa::pth /user:username /domain:domain /ntlm:hash /run:cmd"Identify

Dump local SAM database hashes on the page for mimikatz

mimikatz "lsadump::sam"Identify

Extract Kerberos tickets and export to a file on the page for mimikatz

mimikatz "kerberos::list /export"Identify

List cryptographic providers on the page for mimikatz-crypto

mimikatz "crypto::providers"Identify

List keys in a cryptographic provider on the page for mimikatz-crypto

mimikatz "crypto::capi"Identify

Export certificates and keys on the page for mimikatz-crypto

mimikatz "crypto::certificates /export"Identify

List master keys on the page for mimikatz-dpapi

mimikatz "dpapi::masterkey /list"Identify

Decrypt a DPAPI blob on the page for mimikatz-dpapi

mimikatz "dpapi::blob /in:blob_file.bin"Identify

Retrieve Chrome credentials using DPAPI on the page for mimikatz-dpapi

mimikatz "dpapi::chrome /in:Login Data"Identify

And 31 more examples on CmdID’s program pages.

An example is here when CmdID’s reading of it names T1003.002: a Sigma rule it trips is tagged with it, or its abuse is documented as it.