huntrule

Windows File Writes of HiveNightmare-Style SAM Export Artifacts

Identifies Windows SAM export files written with HiveNightmare-style filename patterns in file events.

FreeReviewedSigma · High · v2
Product
windows
Category
file_event
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2021-07-23
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Cred Access

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies Windows file creation events where the written target filename matches patterns associated with HiveNightmare SAM export tooling. Attackers use SAM dumping to obtain credential material, so these artifacts are a strong indicator of credential-access attempts. Detection relies on file event telemetry that records the TargetFilename path of created/written files and matches multiple filename substrings and an exact temp export location.

Reporting behind it

Related detections9 linkedT1552.001 — drag to rearrange
Suspicious Secret Scanning with trufflehog Verified Results
Suspicious Wireless Credential Theft via netsh wlan Key Export
Malicious NPM Backdoor C2 Beacon to Injective Telemetry Endpoint via Proxy
Suspicious Process Memory Secret Dump via proc mem
Suspicious DNS Exfiltration to azurestaticprovider Backdoor Domain
Suspicious Azure Key Vault Access Policy Modification
Suspicious UAT-10608 Hidden Credential Harvesting Script Execution via nohup
Suspicious Access to Cloud and Database Credential Files via Process
Suspicious Credential Exfiltration to webhook.site (via dns_query)
Windows File Writes of HiveNightmare-Style SAM Export Artifacts
Pivot detection · T1552.001 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.