SigmaHQ/rules/windows/builtin/win_susp_sam_dump.yml

title: SAM Dump to AppData
id: 839dd1e8-eda8-4834-8145-01beeee33acd
status: experimental
description: Detects suspicious SAM dump activity as cause by QuarksPwDump and other password dumpers
tags:
    - attack.credential_access
    - attack.t1003          # an old one
    - attack.t1003.002
author: Florian Roth
date: 2018/01/27
logsource:
    product: windows
    service: system
    definition: The source of this type of event is Kernel-General
detection:
    selection:
        EventID: 16
        Message:
            - '*\AppData\Local\Temp\SAM-*.dmp *'
    condition: selection
falsepositives:
    - Penetration testing
level: high
Massive Title Cleanup 2018-01-27 09:57:30 +00:00			`title: SAM Dump to AppData`
Added UUIDs to rules 2019-11-12 22:12:27 +00:00			`id: 839dd1e8-eda8-4834-8145-01beeee33acd`
Rules: Password dumper activity and lateral movement 2017-03-27 13:20:50 +00:00			`status: experimental`
			`description: Detects suspicious SAM dump activity as cause by QuarksPwDump and other password dumpers`
windows builtin mitre attack tags 2018-07-24 04:34:20 +00:00			`tags:`
Add tags to windows builtin rules 2018-07-24 05:50:32 +00:00			`- attack.credential_access`
att&ck tags review: windows/builtin, windows/driver_load, windows/file_event, windows/image_load, windows/other 2020-08-24 23:09:17 +00:00			`- attack.t1003 # an old one`
Initial round of subtechnique updates 2020-06-16 20:46:08 +00:00			`- attack.t1003.002`
fix: duplicate 'tag' key in rule 2018-09-04 12:56:55 +00:00			`author: Florian Roth`
fix: fixed missing date fields in remaining files 2020-01-30 15:07:37 +00:00			`date: 2018/01/27`
Rules: Password dumper activity and lateral movement 2017-03-27 13:20:50 +00:00			`logsource:`
			`product: windows`
			`service: system`
Replace "logsource: description" with "definition" to match the specs 2018-11-15 06:00:06 +00:00			`definition: The source of this type of event is Kernel-General`
Rules: Password dumper activity and lateral movement 2017-03-27 13:20:50 +00:00			`detection:`
			`selection:`
			`EventID: 16`
fix: bound windows event log rules to message field Fixed rules - rules/windows/builtin/win_susp_msmpeng_crash.yml - rules/windows/builtin/win_alert_active_directory_user_control.yml - rules/windows/builtin/win_av_relevant_match.yml - rules/windows/builtin/win_mal_creddumper.yml - rules/windows/builtin/win_susp_sam_dump.yml - rules/windows/builtin/win_alert_mimikatz_keywords.yml - rules/windows/builtin/win_alert_enable_weak_encryption.yml 2019-11-02 10:25:29 +00:00			`Message:`
			`- '\AppData\Local\Temp\SAM-.dmp *'`
Further fixes and deduplications From suggestions of @yugoslavskiy in issue #554. 2020-02-16 12:30:21 +00:00			`condition: selection`
windows builtin mitre attack tags 2018-07-24 04:34:20 +00:00			`falsepositives:`
Rules: Password dumper activity and lateral movement 2017-03-27 13:20:50 +00:00			`- Penetration testing`
			`level: high`