CyberStack

MITRE ATT&CK / Techniques / T1003.002

OS Credential Dumping: Security Account Manager

ID
T1003.002
Tactics
TA0006 Credential Access
Sub-technique of
T1003 OS Credential Dumping
Platforms
Windows
Data sources
Process Creation, Windows Registry Key Modification, File Creation, File Modification
Source
attack.mitre.org
MITRE last modified
12 May 2026

Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the net user command. Enumerating the SAM database requires SYSTEM level access.

A number of tools can be used to retrieve the SAM file through in-memory techniques:

Alternatively, the SAM can be extracted from the Registry with Reg:

  • reg save HKLM\sam sam
  • reg save HKLM\system system

Creddump7 can then be used to process the SAM database locally to retrieve hashes.[2]

Notes:

  • RID 500 account is the local, built-in administrator.
  • RID 501 is the guest account.
  • User accounts start with a RID of 1,000+.

Detection

Mitigations (4)

M1017 User Training

Limit credential overlap across accounts and systems by training users and administrators not to use the same password for multiple accounts.

M1026 Privileged Account Management

Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.

M1027 Password Policies

Ensure that local administrator accounts have complex, unique passwords across all systems on the network.

M1028 Operating System Configuration

Consider disabling or restricting NTLM.[1]

Groups (14)

Software (15)

References

  1. Microsoft Disable NTLM Nov 2012
  2. GitHub Creddump7