Command Line
reg save HKLM\SECURITY c:\test\security.bak && reg save HKLM\SYSTEM c:\test\system.bak && reg save HKLM\SAM c:\test\sam.bak
Description
Export and save various security-focused pieces of the registry to perform offline retrieval of hashes, key material, etc.
Risk
Critical
Risk Reason
Exporting sensitive registry data typically has few to none legitimate explanations.
Fidelity
High
Fidelity Reason
This is a relatively rare type of behavior.
Operating Systems
Killchain Phases
- Installation
- Actions on Objectives
References
MITRE ATT&CK TECHNIQUES
URL: https://attack.mitre.org/techniques/T1003/002
Description: Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the net user command. Enumerating the SAM database requires SYSTEM level access.
A number of tools can be used to retrieve the SAM file through in-memory techniques:
* pwdumpx.exe
* [gsecdump](https://attack.mitre.org/software/S0008)
* [Mimikatz](https://attack.mitre.org/software/S0002)
* secretsdump.py
Alternatively, the SAM can be extracted from the Registry with Reg:
* reg save HKLM\sam sam
* reg save HKLM\system system
Creddump7 can then be used to process the SAM database locally to retrieve hashes.(Citation: GitHub Creddump7)
Notes:
* RID 500 account is the local, built-in administrator.
* RID 501 is the guest account.
* User accounts start with a RID of 1,000+.
Tactics: