HackTool - Typical HiveNightmare SAM File Export

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•19

This rule detects the creation of files with specific naming conventions that are indicative of tools exploiting the HiveNightmare (CVE-2021-36934) vulnerability to export the Security Account Manager (SAM) database. The rule looks for various file names and patterns used by different implementations of HiveNightmare exploitation tools, including those written in Go, C++, PowerShell, and C#.