Windows File Events: Potential Local SAM Database Export Artifact

title: "Windows File Events: Potential Local SAM Database Export Artifact"
id: e37434f5-2371-4449-ba45-f38018955113
status: test
description: This rule flags Windows file creation events where the target filename matches common patterns used to export or package the local Security Account Manager (SAM), including .sav/.hive outputs and backup/export naming conventions. Such artifacts are valuable to attackers because SAM exports can be used for credential access. The detection relies on file event telemetry, specifically the TargetFilename values ending with or containing these SAM-related substrings and paths.
references:
  - https://github.com/search?q=CVE-2021-36934
  - https://web.archive.org/web/20210725081645/https://github.com/cube0x0/CVE-2021-36934
  - https://www.google.com/search?q=%22reg.exe+save%22+sam
  - https://github.com/HuskyHacks/ShadowSteal
  - https://github.com/FireFart/hivenightmare
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_sam_dump.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-02-11
modified: 2023-01-05
tags:
  - attack.credential-access
  - attack.t1003.002
logsource:
  product: windows
  category: file_event
detection:
  selection:
    - TargetFilename|endswith:
        - \Temp\sam
        - \sam.sav
        - \Intel\sam
        - \sam.hive
        - \Perflogs\sam
        - \ProgramData\sam
        - \Users\Public\sam
        - \AppData\Local\sam
        - \AppData\Roaming\sam
        - _ShadowSteal.zip
        - \Documents\SAM.export
        - :\sam
    - TargetFilename|contains:
        - \hive_sam_
        - \sam.save
        - \sam.export
        - \~reg_sam.save
        - \sam_backup
        - \sam.bck
        - \sam.backup
  condition: selection
falsepositives:
  - Rare cases of administrative activity
level: high
license: DRL-1.1
related:
  - id: 4e87b8e2-2ee9-4b2a-a715-4727d297ece0
    type: derived