rules/windows/builtin/win_susp_sam_dump.yml

title: SAM Dump to AppData
id: 839dd1e8-eda8-4834-8145-01beeee33acd
status: experimental
description: Detects suspicious SAM dump activity as cause by QuarksPwDump and other password dumpers
tags:
    - attack.credential_access
    - attack.t1003          # an old one
    - attack.t1003.002
author: Florian Roth
date: 2018/01/27
logsource:
    product: windows
    service: system
    definition: The source of this type of event is Kernel-General
detection:
    selection:
        EventID: 16
        Message|contains:
            - '\AppData\Local\Temp\SAM-*.dmp'
    condition: selection
falsepositives:
    - Penetration testing
level: high
Massive Title Cleanup 2018-01-27 10:57:30 +01:00			`title: SAM Dump to AppData`
Added UUIDs to rules 2019-11-12 23:12:27 +01:00			`id: 839dd1e8-eda8-4834-8145-01beeee33acd`
Rules: Password dumper activity and lateral movement 2017-03-27 15:20:50 +02:00			`status: experimental`
			`description: Detects suspicious SAM dump activity as cause by QuarksPwDump and other password dumpers`
windows builtin mitre attack tags 2018-07-23 21:34:20 -07:00			`tags:`
Add tags to windows builtin rules 2018-07-24 07:50:32 +02:00			`- attack.credential_access`
att&ck tags review: windows/builtin, windows/driver_load, windows/file_event, windows/image_load, windows/other 2020-08-25 01:09:17 +02:00			`- attack.t1003 # an old one`
Initial round of subtechnique updates 2020-06-16 14:46:08 -06:00			`- attack.t1003.002`
fix: duplicate 'tag' key in rule 2018-09-04 14:56:55 +02:00			`author: Florian Roth`
fix: fixed missing date fields in remaining files 2020-01-30 16:07:37 +01:00			`date: 2018/01/27`
Rules: Password dumper activity and lateral movement 2017-03-27 15:20:50 +02:00			`logsource:`
			`product: windows`
			`service: system`
Replace "logsource: description" with "definition" to match the specs 2018-11-15 09:00:06 +03:00			`definition: The source of this type of event is Kernel-General`
Rules: Password dumper activity and lateral movement 2017-03-27 15:20:50 +02:00			`detection:`
			`selection:`
			`EventID: 16`
Update win_susp_sam_dump.yml 2020-10-15 15:53:26 -03:00			`Message\|contains:`
			`- '\AppData\Local\Temp\SAM-*.dmp'`
Further fixes and deduplications 2020-02-16 13:30:21 +01:00			`condition: selection`
windows builtin mitre attack tags 2018-07-23 21:34:20 -07:00			`falsepositives:`
Rules: Password dumper activity and lateral movement 2017-03-27 15:20:50 +02:00			`- Penetration testing`
			`level: high`