T1003.002: Security Account Manager
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the net user command. Enumerating the SAM database requires SYSTEM level access.
A number of tools can be used to retrieve the SAM file through in-memory techniques:
* pwdumpx.exe * gsecdump * Mimikatz * secretsdump.py
Alternatively, the SAM can be extracted from the Registry with Reg:
* reg save HKLM\sam sam * reg save HKLM\system system
Creddump7 can then be used to process the SAM database locally to retrieve hashes.[1]
Notes:
* RID 500 account is the local, built-in administrator. * RID 501 is the guest account. * User accounts start with a RID of 1,000+.
Analyst context for executives and security teams
This technique matters because it targets local Windows account credential material stored in the Security Account Manager (SAM). If an adversary already has SYSTEM-level access on a host, extracting SAM-derived hashes can support continued credential access and may enable follow-on movement or access to restricted information under the broader OS Credential Dumping technique. For leaders, the practical issue is not just “can we block one tool,” but whether Windows endpoint hardening, privileged access controls, and SOC telemetry can quickly reveal attempts to access or copy sensitive local account stores.
Executive priority
Prioritize this as a Windows credential-access risk tied to privileged access governance and incident response readiness. Because SAM enumeration requires SYSTEM-level access, its presence should trigger questions about how the host was elevated, whether local administrator credentials are reused, and whether local account exposure could expand a contained endpoint incident into a broader business disruption. The relationship context shows this behavior is associated with multiple campaigns and groups, including activity involving energy, government, technology, manufacturing, telecommunications, and critical infrastructure contexts; use that as prioritization context, not proof of current targeting.
Technical view
Validate coverage on Windows endpoints for suspicious access to SAM-related registry hives, local file access patterns, and use of credential dumping utilities named in the ATT&CK description such as Mimikatz, gsecdump, pwdumpx, secretsdump.py, and creddump7 processing. ATT&CK does not provide an official detection section for this object, but the related detection strategy DET0085 is specifically named “Credential Dumping from SAM via Registry Dump and Local File Access,” so detection engineering should focus on registry dump behavior and subsequent local file handling. IR teams should treat confirmed SAM extraction as evidence of prior high privilege on the endpoint and scope for local account hash exposure, especially RID 500 built-in administrator and other local users.
Likely telemetry
- Windows endpoint process execution telemetry, especially privileged command or tool execution
- Registry access or export activity involving SAM and related system hives
- File creation and access telemetry for copied registry hive material or credential-dump output files
- Privilege context evidence showing SYSTEM-level execution or administrative control
- Security tool detections or alerts for known credential dumping utilities referenced by ATT&CK
Detection direction
- Confirm whether DET0085-style logic exists for registry dump and local file access paths related to SAM credential dumping.
- Tune detections around behavior rather than only tool names, because ATT&CK lists multiple tools and in-memory or registry-based approaches.
- Correlate suspicious SAM access with SYSTEM-level process context, recent privilege escalation indicators, and unusual local administrator activity.
- Account for administrative false positives: backup, forensic, or system administration activity may access sensitive hives, so maintain approved tooling and change-window context.
- Do not assume coverage from EDR alert names alone; test whether telemetry captures registry hive access, file creation, and process ancestry needed for triage.
Mitigation priorities
- Start with privileged account management: restrict and monitor accounts capable of reaching SYSTEM or administrative control on Windows hosts.
- Reduce blast radius through strong password policies and avoidance of weak or reused local account credentials where policy and operations permit.
- Harden Windows operating system configurations to limit unnecessary exposure and enforce auditable security settings.
- Use user training as a supporting control for reducing initial compromise paths that may precede SYSTEM-level credential dumping, while recognizing training does not directly prevent SAM access after privilege is obtained.
- Ensure incident response playbooks include local credential exposure decisions, including password/hash reset scope and validation of whether dumped material was created or accessed.
Analyst notes and limits
This is a Windows sub-technique of OS Credential Dumping under credential access. The supplied ATT&CK relationships include one named detection strategy, four mitigations, and numerous campaign/group uses. Those relationships support treating the behavior as broadly relevant across threat contexts, but they do not establish current exploitation against any specific organization. The most defensible security review is evidence-driven: prove whether endpoints log the necessary registry, file, process, and privilege context to investigate SAM access.
ATT&CK provides no official detection text for this object, so detection guidance is derived from the official description and the related DET0085 name. The supplied fields do not include specific data sources, analytic logic, event IDs, or vendor controls. Local environment details are required to determine actual exposure, normal administrative activity, and detection quality.
Security Account Manager
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the net user command. Enumerating the SAM database requires SYSTEM level access.
A number of tools can be used to retrieve the SAM file through in-memory techniques:
* pwdumpx.exe * gsecdump * Mimikatz * secretsdump.py
Alternatively, the SAM can be extracted from the Registry with Reg:
* reg save HKLM\sam sam * reg save HKLM\system system
Creddump7 can then be used to process the SAM database locally to retrieve hashes.[1]
Notes:
* RID 500 account is the local, built-in administrator. * RID 501 is the guest account. * User accounts start with a RID of 1,000+.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1003 | OS Credential Dumping | This object subtechnique of OS Credential Dumping. |
Groups, software, and campaigns
G1034: Daggerfly
Daggerfly is a People's Republic of China-linked APT entity active since at least 2012. Daggerfly has targeted individuals, government and NGO entities, and telecommunication companies in Asia and Africa. Daggerfly is associated with exclusive use of MgBot malware and is noted for several potential supply chain infection campaigns.[1][2][3][4]
G0093: GALLIUM
GALLIUM is a cyberespionage group that has been active since at least 2012, primarily targeting telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam. This group is particularly known for launching Operation Soft Cell, a long-term campaign targeting telecommunications providers.[1] Security researchers have identified GALLIUM as a likely Chinese state-sponsored group, based in part on tools used and TTPs commonly associated with Chinese threat actors.[1][2][3]
G0016: APT29
APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).[1][2] They have operated since at least 2008, often targeting government networks in Europe and NATO member countries, research institutes, and think tanks. APT29 reportedly compromised the Democratic National Committee starting in the summer of 2015.[3][4][5][6]
In April 2021, the US and UK governments attributed the SolarWinds Compromise to the SVR; public statements included citations to APT29, Cozy Bear, and The Dukes.[7][8] Industry reporting also referred to the actors involved in this campaign as UNC2452, NOBELIUM, StellarParticle, Dark Halo, and SolarStorm.[9][10][11][12][13][14]
G1016: FIN13
G1054: MirrorFace
MirrorFace is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the menuPass umbrella based on targeting, tools, and infrastructure overlaps. MirrorFace has been active since at least 2019, at first exclusively targeting Japanese organizations across the media, defense, diplomatic, financial, manufacturing, and academic sectors. Subsequent MirrorFace operations included targets in Central Europe and featured use of LODEINFO, HiddenFace, and UPPERCUT malware.[1][2][3][4][5][6]
G0035: Dragonfly
Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16.[1][2] Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.[3][4][5][6][7][8][9]
G0004: Ke3chang
G1030: Agrius
G0096: APT41
APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.[1] Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.[2][3]
G1023: APT5
APT5 is a China-based espionage actor that has been active since at least 2007 primarily targeting the telecommunications, aerospace, and defense industries throughout the U.S., Europe, and Asia. APT5 has displayed advanced tradecraft and significant interest in compromising networking devices and their underlying software including through the use of zero-day exploits.[1][2][3][4][5][6]
G0045: menuPass
menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company.[1][2]
menuPass has targeted healthcare, defense, aerospace, finance, maritime, biotechnology, energy, and government sectors globally, with an emphasis on Japanese organizations. In 2016 and 2017, the group is known to have targeted managed IT service providers (MSPs), manufacturing and mining companies, and a university.[3][4][5][6][7][1][2]
G0027: Threat Group-3390
Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims.[1] The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.[2][3][4]
S0488: CrackMapExec
CrackMapExec, or CME, is a post-exploitation tool developed in Python and designed for penetration testing against networks. CrackMapExec collects Active Directory information to conduct lateral movement through targeted networks.[1]
S0008: gsecdump
S0250: Koadic
S0006: pwdump
S0376: HOPLIGHT
S0002: Mimikatz
S0125: Remsec
S0046: CozyCar
S0080: Mivast
Mivast is a backdoor that has been used by Deep Panda. It was reportedly used in the Anthem breach. [1]
S0357: Impacket
S0371: POWERTON
S0050: CosmicDuke
CosmicDuke is malware that was used by APT29 from 2010 to 2015. [1]
C0041: FrostyGoop Incident
FrostyGoop Incident took place in January 2024 against a municipal district heating company in Ukraine. Following initial access via likely exploitation of external facing services, FrostyGoop was used to manipulate ENCO control systems via legitimate Modbus commands to impact the delivery of heating services to Ukrainian civilians.[1][2]
C0017: C0017
C0017 was an APT41 campaign conducted between May 2021 and February 2022 that successfully compromised at least six U.S. state government networks through the exploitation of vulnerable Internet facing web applications. During C0017, APT41 was quick to adapt and use publicly-disclosed as well as zero-day vulnerabilities for initial access, and in at least two cases re-compromised victims following remediation efforts. The goals of C0017 are unknown, however APT41 was observed exfiltrating Personal Identifiable Information (PII).[1]
C0061: Operation Digital Eye
Operation Digital Eye was conducted in June and July of 2024 by suspected People's Republic of China (PRC)-nexus threat actors targeting business-to-business IT service providers in Southern Europe. Operation Digital Eye activity included the use of Visual Studio Code tunnels for command and control (C2) and custom lateral movement capabilities. Overlaps in tooling between Digital Eye and previous China-nexus campaigns, Operation Soft Cell and Operation Tainted Love, indicate the potential use of shared vendors or digital quartermasters.[1]
C0002: Night Dragon
Night Dragon was a cyber espionage campaign that targeted oil, energy, and petrochemical companies, along with individuals and executives in Kazakhstan, Taiwan, Greece, and the United States. The unidentified threat actors searched for information related to oil and gas field production systems, financials, and collected data from SCADA systems. Based on the observed techniques, tools, and network activities, security researchers assessed the campaign involved a threat group based in China.[1]
C0051: APT28 Nearest Neighbor Campaign
APT28 Nearest Neighbor Campaign was conducted by APT28 from early February 2022 to November 2024 against organizations and individuals with expertise on Ukraine. APT28 primarily leveraged living-off-the-land techniques, while leveraging the zero-day exploitation of CVE-2022-38028. Notably, APT28 leveraged Wi-Fi networks in close proximity to the intended target to gain initial access to the victim environment. By daisy-chaining multiple compromised organizations nearby the intended target, APT28 discovered dual-homed systems (with both a wired and wireless network connection) to enable Wi-Fi and use compromised credentials to connect to the victim network.[1]
C0012: Operation CuckooBees
Operation CuckooBees was a cyber espionage campaign targeting technology and manufacturing companies in East Asia, Western Europe, and North America since at least 2019. Security researchers noted the goal of Operation CuckooBees, which was still ongoing as of May 2022, was likely the theft of proprietary information, research and development documents, source code, and blueprints for various technologies. Researchers assessed Operation CuckooBees was conducted by actors affiliated with Winnti Group, APT41, and BARIUM.[1]
C0063: 2025 Poland Wiper Attacks
2025 Poland Wiper Attacks is a Russian state-sponsored campaign that conducted destructive cyberattacks against Polish energy infrastructure in December 2025. Targets included more than 30 wind and photovoltaic farms, a combined heat and power (CHP) plant, and a manufacturing sector company. The attacks on the distributed energy resources (DER) disrupted communications between affected facilities and the distribution system operator, but did not impact electricity generation or heat supply. Across the campaign, threat actors deployed two previously undocumented wiper tools, DynoWiper, a Windows-based wiper and LazyWiper, a PowerShell wiper, distributed via malicious Group Policy Objects. At the CHP plant, threat actors had maintained access since at least March 2025, using that foothold to obtain credentials and move laterally before attempting wiper deployment. Some reporting has assessed the activity to be consistent with Russian Federal Security Service (FSB) threat activity group Dragonfly, also tracked as STATIC TUNDRA, while other reporting attributes the destructive wiper activities to the Russian General Staff Main Intelligence Directorate (GRU) threat activity group ELECTRUM, also tracked as Sandworm Team.[1][2][3][4]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.1 | Current bundle | ffb6053dd5d1… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
GitHub Creddump7
Flathers, R. (2018, February 19). creddump7. Retrieved April 11, 2018.
Open source URL -
[2]
mitre-attack T1003.002Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.