rules/windows/builtin/win_susp_sam_dump.yml

title: SAM Dump to AppData
id: 839dd1e8-eda8-4834-8145-01beeee33acd
status: experimental
description: Detects suspicious SAM dump activity as cause by QuarksPwDump and other password dumpers
tags:
    - attack.credential_access
    - attack.t1003
author: Florian Roth
logsource:
    product: windows
    service: system
    definition: The source of this type of event is Kernel-General
detection:
    selection:
        EventID: 16
    keywords:
        Message:
            - '*\AppData\Local\Temp\SAM-*.dmp *'
    condition: all of them
falsepositives:
    - Penetration testing
level: high
Massive Title Cleanup 2018-01-27 10:57:30 +01:00			`title: SAM Dump to AppData`
Added UUIDs to rules 2019-11-12 23:12:27 +01:00			`id: 839dd1e8-eda8-4834-8145-01beeee33acd`
Rules: Password dumper activity and lateral movement 2017-03-27 15:20:50 +02:00			`status: experimental`
			`description: Detects suspicious SAM dump activity as cause by QuarksPwDump and other password dumpers`
windows builtin mitre attack tags 2018-07-23 21:34:20 -07:00			`tags:`
Add tags to windows builtin rules 2018-07-24 07:50:32 +02:00			`- attack.credential_access`
			`- attack.t1003`
fix: duplicate 'tag' key in rule 2018-09-04 14:56:55 +02:00			`author: Florian Roth`
Rules: Password dumper activity and lateral movement 2017-03-27 15:20:50 +02:00			`logsource:`
			`product: windows`
			`service: system`
Replace "logsource: description" with "definition" to match the specs 2018-11-15 09:00:06 +03:00			`definition: The source of this type of event is Kernel-General`
Rules: Password dumper activity and lateral movement 2017-03-27 15:20:50 +02:00			`detection:`
			`selection:`
			`EventID: 16`
Fixed parse errors 2017-08-02 22:49:15 +02:00			`keywords:`
fix: bound windows event log rules to message field 2019-11-02 11:25:29 +01:00			`Message:`
			`- '\AppData\Local\Temp\SAM-.dmp *'`
Simplified rule conditions with new condition constructs 2018-03-06 23:14:43 +01:00			`condition: all of them`
windows builtin mitre attack tags 2018-07-23 21:34:20 -07:00			`falsepositives:`
Rules: Password dumper activity and lateral movement 2017-03-27 15:20:50 +02:00			`- Penetration testing`
			`level: high`