Local File Inclusion - Windows SAM Read

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects attempts to exploit a Local File Inclusion (LFI) vulnerability to read the Windows Security Account Manager (SAM) database. It specifically looks for HTTP requests containing the string "\windows\system32\config\sam" in the URI, which is a common path for the SAM file on Windows systems. Successful exploitation of such a vulnerability could lead to the disclosure of hashed user credentials.