Credential Dumping via the Registry
Description
In Windows operating systems, the Security Account Manager (SAM), SYSTEM, and SECURITY components are used to store local account information, password hashes, and security policies, respectively.
These data are physically stored as files in the C:\Windows\System32\config\ directory. After the system boots, the contents of these physical files are loaded into memory and correspond to registry keys such as HKLM\SAM, HKLM\SYSTEM, and HKLM\SECURITY.
Because these files are locked while the system is running and cannot be accessed directly, attackers often export these registry keys to obtain sensitive credentials.
By leveraging Windows registry backup mechanisms or specialized tools, attackers can extract user account information and password hashes from the SAM database for offline cracking or lateral movement.
Challenge Objective
Write detection rules to identify SAM, credential, and secret registry dumping activities performed through the registry.
When writing detection queries, ensure the
Computerfield is included in the output for further validation.
Data Sample
Data source: Sysmon; sample data:
{ "Channel": "Microsoft-Windows-Sysmon/Operational", "CommandLine": "reg save HKLM\\security C:\\Users\\admin\\AppData\\Local\\Temp\\security", "Company": "Microsoft Corporation", "Computer": "DESKTOP-HKQRH8S", "CurrentDirectory": "C:\\Users\\admin\\AppData\\Local\\Temp\\", "Description": "Registry Console Tool", "EventId": "1", "FileVersion": "10.0.19041.1 (WinBuild.160101.0800)", "Hashes": "MD5=227F63E1D9008B36BDBCC4B397780BE4,SHA256=C0E25B1F9B22DE445298C1E96DDFCEAD265CA030FA6626F61A4A4786CC4A3B7D,IMPHASH=BE482BE427FE212CFEF2CDA0E61F19AC", "Image": "C:\\Windows\\System32\\reg.exe", "IntegrityLevel": "High", "LogonGuid": "{769c9af7-93bf-686f-a893-320400000000}", "LogonId": "0x43293a8", "OriginalFileName": "reg.exe", "ParentCommandLine": "\"cmd.exe\" /c reg save HKLM\\sam %temp%\\sam & reg save HKLM\\system %temp%\\system & reg save HKLM\\security %temp%\\security", "ParentImage": "C:\\Windows\\System32\\cmd.exe", "ParentProcessGuid": "{769c9af7-9651-688c-5071-000000000a00}", "ParentProcessId": "12812", "ParentUser": "DESKTOP-HKQRH8S\\admin", "ProcessGuid": "{769c9af7-9651-688c-5471-000000000a00}", "ProcessId": "6916", "Product": "Microsoft? Windows? Operating System", "RuleName": "-", "SystemTime": "2025-08-01T10:26:25.9602081Z", "TerminalSessionId": "2", "User": "DESKTOP-HKQRH8S\\admin", "UtcTime": "2025-08-01 10:26:25.948",}References
Fields
No fields found