credentail_access_file_access_to_sam_database.yml

name: File access to SAM database
id: e3dace20-4962-4381-884e-40dcdde66626
version: 1.0.1
description: |
  Identifies access to the Security Account Manager on-disk database.
labels:
  tactic.id: TA0006
  tactic.name: Credential Access
  tactic.ref: https://attack.mitre.org/tactics/TA0006/
  technique.id: T1003
  technique.name: OS Credential Dumping
  technique.ref: https://attack.mitre.org/techniques/T1003/
  subtechnique.id: T1003.002
  subtechnique.name: Security Account Manager
  subtechnique.ref: https://attack.mitre.org/techniques/T1003/002/

condition: >
  open_file
    and
  file.path imatches
    (
      '?:\\WINDOWS\\SYSTEM32\\CONFIG\\SAM',
      '\\Device\\HarddiskVolumeShadowCopy*\\WINDOWS\\SYSTEM32\\CONFIG\\SAM',
      '\\??\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy*\\WINDOWS\\SYSTEM32\\CONFIG\\SAM'
    )
    and
    not
  ps.exe imatches
    (
      '?:\\Program Files\\*',
      '?:\\Program Files (x86)\\*',
      '?:\\Windows\\System32\\lsass.exe'
    )

min-engine-version: 2.4.0