<jupyter_start><jupyter_text>SAM Registry Hive Handle Request  Metadata |     Metadata      |  Value  ||:------------------|:---|| collaborators     | ['@Cyb3rWard0g', '@Cyb3rPandaH'] || creation date     | 2019/07/25 || modification date | 2020/09/20 || playbook related  | ['WIN-190625024610'] |  HypothesisAdversaries might be getting a handle to the SAM database to extract credentials in my environment  Technical ContextEvery computer that runs Windows has its own local domain; that is, it has an account database for accounts that are specific to that computer.Conceptually,this is an account database like any other with accounts, groups, SIDs, and so on.These are referred to as local accounts, local groups, and so on.Because computers typically do not trust each other for account information, these identities stay local to the computer on which they were created.  Offensive TradecraftAdversaries might use tools like Mimikatz with lsadump::sam commands or scripts such as Invoke-PowerDump to get the SysKey to decrypt Security Account Mannager (SAM) database entries (from registry or hive) and get NTLM, and sometimes LM hashes of local accounts passwords.In addition, adversaries can use the built-in Reg.exe utility to dump the SAM hive in order to crack it offline.Additional reading* https://github.com/OTRF/ThreatHunter-Playbook/tree/master/docs/library/windows/security_account_manager_database.md* https://github.com/OTRF/ThreatHunter-Playbook/tree/master/docs/library/windows/syskey.md  Security Datasets | Metadata  |    Value  ||:----------|:----------|| docs      | https://securitydatasets.com/notebooks/atomic/windows/credential_access/SDWIN-190625103712.html        || link      | [https://raw.githubusercontent.com/OTRF/Security-Datasets/master/datasets/atomic/windows/credential_access/host/empire_mimikatz_sam_access.zip](https://raw.githubusercontent.com/OTRF/Security-Datasets/master/datasets/atomic/windows/credential_access/host/empire_mimikatz_sam_access.zip)  |  Analytics  Initialize Analytics Engine<jupyter_code>from openhunt.mordorutils import *
spark = get_spark()<jupyter_output><empty_output><jupyter_text>Download & Process Security Dataset<jupyter_code>sd_file = "https://raw.githubusercontent.com/OTRF/Security-Datasets/master/datasets/atomic/windows/credential_access/host/empire_mimikatz_sam_access.zip"
registerMordorSQLTable(spark, sd_file, "sdTable")<jupyter_output><empty_output><jupyter_text>Analytic IMonitor for any handle requested for the SAM registry hive | Data source | Event Provider | Relationship | Event ||:------------|:---------------|--------------|-------|| Windows registry | Microsoft-Windows-Security-Auditing | Process requested access Windows registry key | 4656 || Windows registry | Microsoft-Windows-Security-Auditing | User requested access Windows registry key | 4656 |<jupyter_code>df = spark.sql(
'''
SELECT `@timestamp`, Hostname, SubjectUserName, ProcessName, ObjectName, AccessMask
FROM sdTable
WHERE LOWER(Channel) = "security"
    AND EventID = 4656
    AND ObjectType = "Key"
    AND lower(ObjectName) LIKE "%sam"
'''
)
df.show(10,False)<jupyter_output><empty_output>
{'fraction_non_alphanumeric': 0.11565272496831432, 'fraction_numerical': 0.01806083650190114, 'mean_word_length': 4.708860759493671, 'pattern_counts': {'":': 0, '<': 13, '<?xml version=': 0, '>': 13, 'https://': 6, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 1, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'chain_length': '3', 'dir': 'jupyter-structured-clean-dedup', 'id': '405517', 'license': 'MIT', 'n_tokens_mistral': 951, 'n_tokens_neox': 883, 'n_words': 257, 'path': 'docs/notebooks/windows/06_credential_access/WIN-190725024610.ipynb', 'repo_name': 'hitenkoku/ThreatHunter-Playbook', 'size': '3156'}