Windows File Writes of HiveNightmare-Style SAM Export Artifacts

Identifies Windows SAM export files written with HiveNightmare-style filename patterns in file events.

FreeReviewedSigma · High · v2

Product: windows
Category: file_event
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2021-07-23
Updated: 2026-07-31

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1552.001Credentials In Files
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Windows file creation events where the written target filename matches patterns associated with HiveNightmare SAM export tooling. Attackers use SAM dumping to obtain credential material, so these artifacts are a strong indicator of credential-access attempts. Detection relies on file event telemetry that records the TargetFilename path of created/written files and matches multiple filename substrings and an exact temp export location.

Reporting behind it

Related detections9 linkedT1552.001 — drag to rearrange

Suspicious Secret Scanning with trufflehog Verified Results

Suspicious Wireless Credential Theft via netsh wlan Key Export

Malicious NPM Backdoor C2 Beacon to Injective Telemetry Endpoint via Proxy

Suspicious Process Memory Secret Dump via proc mem

Suspicious DNS Exfiltration to azurestaticprovider Backdoor Domain

Suspicious Azure Key Vault Access Policy Modification

Suspicious UAT-10608 Hidden Credential Harvesting Script Execution via nohup

Suspicious Access to Cloud and Database Credential Files via Process

Suspicious Credential Exfiltration to webhook.site (via dns_query)

Windows File Writes of HiveNightmare-Style SAM Export Artifacts

Pivot detection · T1552.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-hacktool-activity-hivenightmare-style-sam-file-exports-6ea858a8

title: Windows File Writes of HiveNightmare-Style SAM Export Artifacts
id: a33dc8e4-a0e8-4c98-b521-2288eef945e4
status: test
description: This rule identifies Windows file creation events where the written target filename matches patterns associated with HiveNightmare SAM export tooling. Attackers use SAM dumping to obtain credential material, so these artifacts are a strong indicator of credential-access attempts. Detection relies on file event telemetry that records the TargetFilename path of created/written files and matches multiple filename substrings and an exact temp export location.
references:
  - https://github.com/GossiTheDog/HiveNightmare
  - https://github.com/FireFart/hivenightmare/
  - https://github.com/WiredPulse/Invoke-HiveNightmare
  - https://twitter.com/cube0x0/status/1418920190759378944
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_hktl_hivenightmare_file_exports.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-07-23
modified: 2024-06-27
tags:
  - attack.credential-access
  - attack.t1552.001
  - cve.2021-36934
logsource:
  product: windows
  category: file_event
detection:
  selection:
    - TargetFilename|contains:
        - \hive_sam_
        - \SAM-2021-
        - \SAM-2022-
        - \SAM-2023-
        - \SAM-haxx
        - \Sam.save
    - TargetFilename: C:\windows\temp\sam
  condition: selection
falsepositives:
  - Files that accidentally contain these strings
level: high
license: DRL-1.1
related:
  - id: 6ea858a8-ba71-4a12-b2cc-5d83312404c7
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL