PowerShell SAM Hive Copy via Volume Shadow Copy Paths on Windows

Flags PowerShell commands that copy the SAM hive from Volume Shadow Copy locations using .NET or PowerShell copy semantics.

FreeUnreviewedSigmahighv1

powershell-sam-hive-copy-via-volume-shadow-copy-paths-on-windows-1af57a4b

title: PowerShell SAM Hive Copy via Volume Shadow Copy Paths on Windows
id: 3a3161aa-a358-41f3-a755-58ff742d9f70
status: test
description: This rule identifies PowerShell executions whose command lines reference the SAM hive under System32\config\sam while also including Volume Shadow Copy paths. It further matches copy operations typical of attempts to duplicate sensitive credential store data for offline access. The detection relies on Windows process creation telemetry and PowerShell command-line contents indicating both the target hive path and the copy behavior.
references:
  - https://twitter.com/splinter_code/status/1420546784250769408
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_sam_access.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-07-29
modified: 2023-01-06
tags:
  - attack.credential-access
  - attack.t1003.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_1:
    CommandLine|contains|all:
      - \HarddiskVolumeShadowCopy
      - System32\config\sam
  selection_2:
    CommandLine|contains:
      - Copy-Item
      - cp $_.
      - cpi $_.
      - copy $_.
      - .File]::Copy(
  condition: all of selection*
falsepositives:
  - Some rare backup scenarios
  - PowerShell scripts fixing HiveNightmare / SeriousSAM ACLs
level: high
license: DRL-1.1
related:
  - id: 1af57a4b-460a-4738-9034-db68b880c665
    type: derived

What it detects

This rule identifies PowerShell executions whose command lines reference the SAM hive under System32\config\sam while also including Volume Shadow Copy paths. It further matches copy operations typical of attempts to duplicate sensitive credential store data for offline access. The detection relies on Windows process creation telemetry and PowerShell command-line contents indicating both the target hive path and the copy behavior.

Known false positives

Some rare backup scenarios
PowerShell scripts fixing HiveNightmare / SeriousSAM ACLs

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.