SAM database dumping

Local account hashes extracted from the SAM hive

categoryIdentity, authentication and credential attacksseverityHighdetectability (measured in our lab)Mediumlabdetected in lab

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1003.002 · dump volume shadow copy hives with System.IO.File · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1003.002 -Tool atomic -RunId <run-id> -Command 'Invoke-AtomicTest T1003.002 -TestGuids 9d77fed7-05f8-476e-a81b-8ff0472c64d0 -TimeoutSeconds 120'

ATT&CK T1003.002 · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1003.002 -Tool atomic -RunId run-2026-10-14-004 -Command 'Invoke-AtomicTest T1003.002 -TestGuids 9d77fed7-05f8-476e-a81b-8ff0472c64d0 -TimeoutSeconds 120'

ATT&CK T1003.002 · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1003.002 -Tool atomic -RunId run-2026-10-14-008 -Command 'Invoke-AtomicTest T1003.002 -TestGuids 9d77fed7-05f8-476e-a81b-8ff0472c64d0 -TimeoutSeconds 120'

+ 2 more test variant(s) in the corpus.

What our lab measured

detected windows · 2026-10-27 · detected in 4s

What it looked like in telemetry

Log source	What it means
Sysmon · EID 1	Access token manipulation: SYSTEM-integrity process created by a non-service parent
Sysmon · EID 1	Powershell used to copy SAM hive from VSS
Event · EID 102	The database engine is starting a new instance.
Sysmon · EID 11	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe created a new scripting file under Windows Temp or User data folder
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
Event · EID 16384	Software protection service scheduled successfully.
Event · EID 300	The database engine is initiating recovery steps.
Event · EID 301	The database engine is replaying log file C:\Winnt\system32\wins\j50.log.
… and 13 more event type(s)

Detection that fired

✓ Wazuh 100230 (level 10) lab rule — Access token manipulation: SYSTEM-integrity process created by a non-service parent

Plus 20 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~97958 incidental alerts/hour — tune against this.

detected windows · 2026-10-18 · detected in 1s

What it looked like in telemetry

Log source	What it means
Sysmon · EID 1	Access token manipulation: SYSTEM-integrity process created by a non-service parent
Sysmon · EID 1	Powershell used to copy SAM hive from VSS
Sysmon · EID 11	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe created a new scripting file under Windows Temp or User data folder
Sysmon · EID 11	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe created a new scripting file under Windows Temp or User data folder
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
Event · EID 16384	Software protection service scheduled successfully.
PowerShell · EID 4104	Powershell script querying system environment variables
PowerShell · EID 4104	Powershell script recursively collected files from a filesystem search
… and 8 more event type(s)

Detection that fired

✓ Wazuh 100230 (level 10) lab rule — Access token manipulation: SYSTEM-integrity process created by a non-service parent

Plus 18 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~87013 incidental alerts/hour — tune against this.

Classification

23 values: 13 reviewed, 3 lab-measured, 6 imported, 1 derived. What do these mean?

Exploitability

Attack vector	Credential attacks
Reach (CVSS)	Local
Attack complexity	Low
Privileges required	High
User interaction	None
Attacker skill required	Low
Resources required	Low
Likelihood / prevalence	High
Maturity	Commoditized

Impact & scope

Severity	High
Impact	Confidentiality
Platform	Windows
Environment	On-premises
Target asset class	EndpointIdentity
Kill-chain phase (tactic)	Credential Access

Detection & telemetry

Detectability (measured in our lab)	Medium
Detectability (public detection content)	High
Noise level	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	File CreationFile ModificationProcess CreationWindows Registry Key Modification

Detection & response

Mitigated by 18

M1017 attack-mitigation
M1026 attack-mitigation
M1027 attack-mitigation
M1028 attack-mitigation
D3-ABPI d3fend
D3-DI d3fend
D3-HBPI d3fend
D3-HR d3fend
D3-HS d3fend
D3-KBPI d3fend
D3-PLA d3fend
D3-PS d3fend
D3-PSA d3fend
D3-PSMD d3fend
D3-PT d3fend
D3-RD d3fend
D3-SCF d3fend
D3-WSAM d3fend

Detected by 30

DET0085 attack-detection-strategy
0685b176-c816-4837-8e7b-1216f346636b sigma
06d71506-7beb-4f22-8888-e2e5e2ca7fd8 sigma
11b1ed55-154d-4e82-8ad7-83739298f720 sigma
1af57a4b-460a-4738-9034-db68b880c665 sigma
252902e3-5830-4cf6-bf21-c22083dfd5cf sigma
2e69f167-47b5-4ae7-a390-47764529eff5 sigma
2fcda7e2-8c57-4904-86ac-37fc3157e09d sigma
39f919f3-980b-4e6f-a975-8af7e507ef2b sigma
40b19fa6-d835-400c-b301-41f3a2baacaf sigma
4976aa50-8f41-45c6-8b15-ab3fc10e79ed sigma
4e87b8e2-2ee9-4b2a-a715-4727d297ece0 sigma
5aad0995-46ab-41bd-a9ff-724f41114971 sigma
78cc2dd2-7d20-4d32-93ff-057084c38b93 sigma
847def9e-924d-4e90-b7c4-5f581395a2b4 sigma
882fbe50-d8d7-4e29-ae80-0648a8556866 sigma
8a1b2c3d-4e5f-6789-abcd-ef1234567890 sigma
8fbf3271-1ef6-4e94-8210-03c2317947f6 sigma
910ab938-668b-401b-b08c-b596e80fdca5 sigma
92dae1ed-1c9d-4eff-a567-33acbd95b00e sigma
961d0ba2-3eea-4303-a930-2cf78bbfcc5e sigma
a29808fd-ef50-49ff-9c7a-59a9b040b404 sigma
a642964e-bead-4bed-8910-1bb4d63e3b4d sigma
b17ea6f7-6e90-447e-a799-e6c0a493d6ce sigma
e7be6119-fc37-43f0-ad4f-1f3f99be2f9f sigma
e9faba72-4974-4ab2-a4c5-46e25ad59e9b sigma
f0d1feba-4344-4ca9-8121-a6c97bd6df52 sigma
f512acbf-e662-4903-843e-97ce4652b740 sigma
fd877b94-9bb5-4191-bb25-d79cbd93c167 sigma
92024 wazuh

Tested by 8

0c0f5f06-166a-4f4d-bb4a-719df9a01dbb atomic
21df41be-cdd8-4695-a650-c3981113aa3c atomic
5c2571d0-1572-416d-9676-812e64ca9f44 atomic
804f28fc-68fc-40da-b5a2-e9d0bce5c193 atomic
9d77fed7-05f8-476e-a81b-8ff0472c64d0 atomic
a90c2f4d-6726-444e-99d2-a00cd7c20480 atomic
a96872b2-cbf3-46cf-8eb4-27e8c0e85263 atomic
eeb9751a-d598-42d3-b11c-c122d9c3f6c7 atomic

Attack relationships

Parent: Credential-dumping tooling

Lab findings

Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.

Run	Outcome	Tool	Platform	Ran at
`run-2026-10-14-004`	detected	atomic	windows	2026-10-14
`run-2026-10-14-008`	detected	atomic	windows	2026-10-14
`run-2026-10-18-012`	detected	atomic	windows	2026-10-18
`run-2026-10-27-003`	detected	atomic	windows	2026-10-27

run-2026-10-14-004 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=8). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1003.002 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=1 incidental=13 max_level=15 dwell_s=90
run-2026-10-14-008 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=8). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1003.002 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=1 incidental=13 max_level=15 dwell_s=90
run-2026-10-18-012 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=8). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1003.002 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=1 incidental=2272 max_level=15 dwell_s=90
run-2026-10-27-003 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=8). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1003.002 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=1 incidental=2585 max_level=15 dwell_s=90

Framework references

Primary source: https://attack.mitre.org/techniques/T1003/
attack: T1003.002 (primary)

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Identity, authentication and credential attacks' table, line 334 of Cyber-Attack-Taxonomy.md
ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 36 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0003 (Phase 4 detection lab - detonation runs 2026-10-14) — Lab detonation run-2026-10-14-004 (detected): Wazuh rule(s) 92024 fired on T1003.002 within the detonation window
Powershell used to copy SAM hive from VSS
ev-0004 (Phase 4 detection lab - detonation runs 2026-10-14) — Lab detonation run-2026-10-14-008 (detected): Wazuh rule(s) 92024 fired on T1003.002 within the detonation window
Powershell used to copy SAM hive from VSS
ev-0005 (Phase 4 detection lab - detonation runs 2026-10-18) — Lab detonation run-2026-10-18-012 (detected): Wazuh rule(s) 92024 fired on T1003.002 within the detonation window
Powershell used to copy SAM hive from VSS
ev-0006 (Phase 4 detection lab - detonation runs 2026-10-27) — Lab detonation run-2026-10-27-003 (detected): Wazuh rule(s) 92024 fired on T1003.002 within the detonation window
Powershell used to copy SAM hive from VSS