TA0006 · CREDENTIAL ACCESS
Security Account Manager
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored.
Detect it with
Hash dumpers open the Security Accounts Manager (SAM) on the local file system ( %SystemRoot%/system32/config/SAM ) or create a dump of the Registry SAM key to access stored account password hashes.
Why it matters on shift
Security Account Manager is one of the concrete ways adversaries achieve credential access. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After credential access, the next tactic is usually Discovery. Search your telemetry for the transition before closing the ticket.
Kill-chain context