Potential SAM Database Dump

SigmaHQ Detections@sigmaHQ

•updated Sep 13, 2024•1•0•25

Detects the creation of files that resemble exports of the local Security Account Manager (SAM) database. This activity is often associated with credential dumping techniques used by adversaries to obtain local user hashes. The rule specifically looks for common filenames and paths used when dumping the SAM hive, including those related to known exploits like CVE-2021-36934 and tools like ShadowSteal and hivenightmare.