PowerShell SAM Hive Copy via Volume Shadow Copy Paths on Windows
Flags PowerShell commands that copy the SAM hive from Volume Shadow Copy locations using .NET or PowerShell copy semantics.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-07-29
- Updated
- 2026-07-30
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies PowerShell executions whose command lines reference the SAM hive under System32\config\sam while also including Volume Shadow Copy paths. It further matches copy operations typical of attempts to duplicate sensitive credential store data for offline access. The detection relies on Windows process creation telemetry and PowerShell command-line contents indicating both the target hive path and the copy behavior.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: PowerShell SAM Hive Copy via Volume Shadow Copy Paths on Windows
id: 3a3161aa-a358-41f3-a755-58ff742d9f70
status: test
description: This rule identifies PowerShell executions whose command lines reference the SAM hive under System32\config\sam while also including Volume Shadow Copy paths. It further matches copy operations typical of attempts to duplicate sensitive credential store data for offline access. The detection relies on Windows process creation telemetry and PowerShell command-line contents indicating both the target hive path and the copy behavior.
references:
- https://twitter.com/splinter_code/status/1420546784250769408
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_sam_access.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-07-29
modified: 2023-01-06
tags:
- attack.credential-access
- attack.t1003.002
logsource:
category: process_creation
product: windows
detection:
selection_1:
CommandLine|contains|all:
- \HarddiskVolumeShadowCopy
- System32\config\sam
selection_2:
CommandLine|contains:
- Copy-Item
- cp $_.
- cpi $_.
- copy $_.
- .File]::Copy(
condition: all of selection*
falsepositives:
- Some rare backup scenarios
- PowerShell scripts fixing HiveNightmare / SeriousSAM ACLs
level: high
license: DRL-1.1
related:
- id: 1af57a4b-460a-4738-9034-db68b880c665
type: derived