Esc
Security Account Manager - T1003.002

(ATT&CK® Technique)
Definition

Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the net user command. Enumerating the SAM database requires SYSTEM level access.
D3FEND Inferred Relationships

Browse the D3FEND knowledge graph by clicking on the nodes below.
        graph LR;

     T1003002["Security Account Manager"] --> |may-access| Process["Process"]; class T1003002 OffensiveTechniqueNode;
        class Process ArtifactNode; click Process href "/dao/artifact/d3f:Process";
        click T1003002 href "/offensive-technique/attack/T1003.002/"; click Process href "/dao/artifact/d3f:Process"; T1003002["Security Account Manager"] --> |may-access| SystemPasswordDatabase["System Password Database"]; class T1003002 OffensiveTechniqueNode;
        class SystemPasswordDatabase ArtifactNode; click SystemPasswordDatabase href "/dao/artifact/d3f:SystemPasswordDatabase";
        click T1003002 href "/offensive-technique/attack/T1003.002/"; click SystemPasswordDatabase href "/dao/artifact/d3f:SystemPasswordDatabase"; T1003002["Security Account Manager"] --> |may-access| AuthenticationService["Authentication Service"]; class T1003002 OffensiveTechniqueNode;
        class AuthenticationService ArtifactNode; click AuthenticationService href "/dao/artifact/d3f:AuthenticationService";
        click T1003002 href "/offensive-technique/attack/T1003.002/"; click AuthenticationService href "/dao/artifact/d3f:AuthenticationService";                                       ProcessSelf-ModificationDetection["Process Self-Modification Detection"] -->
          | analyzes | AuthenticationService["Authentication Service"];

          ProcessSelf-ModificationDetection["Process Self-Modification Detection"] -.->
            | may-detect | T1003002["Security Account Manager"] ;
          class ProcessSelf-ModificationDetection DefensiveTechniqueNode;
          class AuthenticationService ArtifactNode;
          click ProcessSelf-ModificationDetection href "/technique/d3f:ProcessSelf-ModificationDetection"; ProcessSelf-ModificationDetection["Process Self-Modification Detection"] -->
          | analyzes | Process["Process"];

          
          class ProcessSelf-ModificationDetection DefensiveTechniqueNode;
          class Process ArtifactNode;
          click ProcessSelf-ModificationDetection href "/technique/d3f:ProcessSelf-ModificationDetection"; ProcessSpawnAnalysis["Process Spawn Analysis"] -->
          | analyzes | AuthenticationService["Authentication Service"];

          ProcessSpawnAnalysis["Process Spawn Analysis"] -.->
            | may-detect | T1003002["Security Account Manager"] ;
          class ProcessSpawnAnalysis DefensiveTechniqueNode;
          class AuthenticationService ArtifactNode;
          click ProcessSpawnAnalysis href "/technique/d3f:ProcessSpawnAnalysis"; ProcessSpawnAnalysis["Process Spawn Analysis"] -->
          | analyzes | Process["Process"];

          
          class ProcessSpawnAnalysis DefensiveTechniqueNode;
          class Process ArtifactNode;
          click ProcessSpawnAnalysis href "/technique/d3f:ProcessSpawnAnalysis";                                                     Application-basedProcessIsolation["Application-based Process Isolation"] -->
          | isolates | AuthenticationService["Authentication Service"];

          Application-basedProcessIsolation["Application-based Process Isolation"] -.->
            | may-isolate | T1003002["Security Account Manager"] ;
          class Application-basedProcessIsolation DefensiveTechniqueNode;
          class AuthenticationService ArtifactNode;
          click Application-basedProcessIsolation href "/technique/d3f:Application-basedProcessIsolation"; Application-basedProcessIsolation["Application-based Process Isolation"] -->
          | isolates | Process["Process"];

          
          class Application-basedProcessIsolation DefensiveTechniqueNode;
          class Process ArtifactNode;
          click Application-basedProcessIsolation href "/technique/d3f:Application-basedProcessIsolation"; SystemCallFiltering["System Call Filtering"] -->
          | isolates | AuthenticationService["Authentication Service"];

          SystemCallFiltering["System Call Filtering"] -.->
            | may-isolate | T1003002["Security Account Manager"] ;
          class SystemCallFiltering DefensiveTechniqueNode;
          class AuthenticationService ArtifactNode;
          click SystemCallFiltering href "/technique/d3f:SystemCallFiltering"; SystemCallFiltering["System Call Filtering"] -->
          | isolates | Process["Process"];

          
          class SystemCallFiltering DefensiveTechniqueNode;
          class Process ArtifactNode;
          click SystemCallFiltering href "/technique/d3f:SystemCallFiltering";                                                     ProcessSuspension["Process Suspension"] -->
          | suspends | AuthenticationService["Authentication Service"];

          ProcessSuspension["Process Suspension"] -.->
            | may-evict | T1003002["Security Account Manager"] ;
          class ProcessSuspension DefensiveTechniqueNode;
          class AuthenticationService ArtifactNode;
          click ProcessSuspension href "/technique/d3f:ProcessSuspension"; ProcessSuspension["Process Suspension"] -->
          | suspends | Process["Process"];

          
          class ProcessSuspension DefensiveTechniqueNode;
          class Process ArtifactNode;
          click ProcessSuspension href "/technique/d3f:ProcessSuspension"; HostShutdown["Host Shutdown"] -->
          | terminates | AuthenticationService["Authentication Service"];

          HostShutdown["Host Shutdown"] -.->
            | may-evict | T1003002["Security Account Manager"] ;
          class HostShutdown DefensiveTechniqueNode;
          class AuthenticationService ArtifactNode;
          click HostShutdown href "/technique/d3f:HostShutdown"; HostShutdown["Host Shutdown"] -->
          | terminates | Process["Process"];

          
          class HostShutdown DefensiveTechniqueNode;
          class Process ArtifactNode;
          click HostShutdown href "/technique/d3f:HostShutdown";                                                     ProcessLineageAnalysis["Process Lineage Analysis"] -->
          | analyzes | Process["Process"];

          ProcessLineageAnalysis["Process Lineage Analysis"] -.->
            | may-detect | T1003002["Security Account Manager"] ;
          class ProcessLineageAnalysis DefensiveTechniqueNode;
          class Process ArtifactNode;
          click ProcessLineageAnalysis href "/technique/d3f:ProcessLineageAnalysis"; ProcessLineageAnalysis["Process Lineage Analysis"] -->
          | analyzes | AuthenticationService["Authentication Service"];

          
          class ProcessLineageAnalysis DefensiveTechniqueNode;
          class AuthenticationService ArtifactNode;
          click ProcessLineageAnalysis href "/technique/d3f:ProcessLineageAnalysis";                           ProcessTermination["Process Termination"] -->
          | terminates | AuthenticationService["Authentication Service"];

          ProcessTermination["Process Termination"] -.->
            | may-evict | T1003002["Security Account Manager"] ;
          class ProcessTermination DefensiveTechniqueNode;
          class AuthenticationService ArtifactNode;
          click ProcessTermination href "/technique/d3f:ProcessTermination"; ProcessTermination["Process Termination"] -->
          | terminates | Process["Process"];

          
          class ProcessTermination DefensiveTechniqueNode;
          class Process ArtifactNode;
          click ProcessTermination href "/technique/d3f:ProcessTermination";                           Hardware-basedProcessIsolation["Hardware-based Process Isolation"] -->
          | isolates | AuthenticationService["Authentication Service"];

          Hardware-basedProcessIsolation["Hardware-based Process Isolation"] -.->
            | may-isolate | T1003002["Security Account Manager"] ;
          class Hardware-basedProcessIsolation DefensiveTechniqueNode;
          class AuthenticationService ArtifactNode;
          click Hardware-basedProcessIsolation href "/technique/d3f:Hardware-basedProcessIsolation"; Hardware-basedProcessIsolation["Hardware-based Process Isolation"] -->
          | isolates | Process["Process"];

          
          class Hardware-basedProcessIsolation DefensiveTechniqueNode;
          class Process ArtifactNode;
          click Hardware-basedProcessIsolation href "/technique/d3f:Hardware-basedProcessIsolation"; Kernel-basedProcessIsolation["Kernel-based Process Isolation"] -->
          | isolates | AuthenticationService["Authentication Service"];

          Kernel-basedProcessIsolation["Kernel-based Process Isolation"] -.->
            | may-isolate | T1003002["Security Account Manager"] ;
          class Kernel-basedProcessIsolation DefensiveTechniqueNode;
          class AuthenticationService ArtifactNode;
          click Kernel-basedProcessIsolation href "/technique/d3f:Kernel-basedProcessIsolation"; Kernel-basedProcessIsolation["Kernel-based Process Isolation"] -->
          | isolates | Process["Process"];

          
          class Kernel-basedProcessIsolation DefensiveTechniqueNode;
          class Process ArtifactNode;
          click Kernel-basedProcessIsolation href "/technique/d3f:Kernel-basedProcessIsolation";                                                     WebSessionAccessMediation["Web Session Access Mediation"] -->
          | isolates | AuthenticationService["Authentication Service"];

          WebSessionAccessMediation["Web Session Access Mediation"] -.->
            | may-isolate | T1003002["Security Account Manager"] ;
          class WebSessionAccessMediation DefensiveTechniqueNode;
          class AuthenticationService ArtifactNode;
          click WebSessionAccessMediation href "/technique/d3f:WebSessionAccessMediation";               RestoreDatabase["Restore Database"] -->
          | restores | SystemPasswordDatabase["System Password Database"];

          RestoreDatabase["Restore Database"] -.->
            | may-restore | T1003002["Security Account Manager"] ;
          class RestoreDatabase DefensiveTechniqueNode;
          class SystemPasswordDatabase ArtifactNode;
          click RestoreDatabase href "/technique/d3f:RestoreDatabase";                           HostReboot["Host Reboot"] -->
          | terminates | AuthenticationService["Authentication Service"];

          HostReboot["Host Reboot"] -.->
            | may-evict | T1003002["Security Account Manager"] ;
          class HostReboot DefensiveTechniqueNode;
          class AuthenticationService ArtifactNode;
          click HostReboot href "/technique/d3f:HostReboot"; HostReboot["Host Reboot"] -->
          | terminates | Process["Process"];

          
          class HostReboot DefensiveTechniqueNode;
          class Process ArtifactNode;
          click HostReboot href "/technique/d3f:HostReboot";
json