ATT&CKProcedure examples

Procedure examples

Real-world descriptions of how a group, tool or campaign used a technique.

Technique: T1003.002×

14 examples

Technique	Used by	Procedure example
T1003.002 Security Account Manager	GroupGALLIUM	GALLIUM used `reg` commands to dump specific hives from the Windows Registry, such as the SAM hive, and obtain password hashes. Cybereason Soft Cell June 2019
T1003.002 Security Account Manager	GroupAPT41	APT41 extracted user account data from the Security Account Managerr (SAM), making a copy of this database from the registry using the `reg save` command or by exploiting volume shadow copies. Rostovcev APT41 2021
T1003.002 Security Account Manager	GroupDragonfly	Dragonfly has dropped and executed SecretsDump to dump password hashes. US-CERT TA18-074A
T1003.002 Security Account Manager	GroupmenuPass	menuPass has used a modified version of pentesting tools wmiexec.vbs and secretsdump.py to dump credentials. Github AD-Pentest-Script PWC Cloud Hopper Technical Annex April 2017
T1003.002 Security Account Manager	GroupKe3chang	Ke3chang has dumped credentials, including by using gsecdump. Mandiant Operation Ke3chang November 2014 NCC Group APT15 Alive and Strong
T1003.002 Security Account Manager	GroupAPT29	APT29 has used the `reg save` command to save registry hives. Mandiant APT29 Eye Spy Email Nov 22
T1003.002 Security Account Manager	GroupMirrorFace	MirrorFace has used vssadmin to copy registry hives including SAM. JPCERT MirrorFace JUL 2024 Trend Micro Earth Kasha NOV 2024
T1003.002 Security Account Manager	GroupEmber Bear	Ember Bear acquires victim credentials by extracting registry hives such as the Security Account Manager through commands such as `reg save`. CISA GRU29155 2024 Cadet Blizzard emerges as novel threat actor
T1003.002 Security Account Manager	GroupAgrius	Agrius dumped the SAM file on victim machines to capture credentials. Unit42 Agrius 2023
T1003.002 Security Account Manager	GroupAPT5	APT5 has copied and exfiltrated the SAM Registry hive from targeted systems. Mandiant Pulse Secure Update May 2021
T1003.002 Security Account Manager	GroupWizard Spider	Wizard Spider has acquired credentials from the SAM/SECURITY registry hives. FireEye KEGTAP SINGLEMALT October 2020
T1003.002 Security Account Manager	GroupDaggerfly	Daggerfly used Reg to dump the Security Account Manager (SAM) hive from victim machines for follow-on credential extraction. Symantec Daggerfly 2023
T1003.002 Security Account Manager	GroupThreat Group-3390	Threat Group-3390 actors have used gsecdump to dump credentials. They have also dumped credentials from domain controllers. Dell TG-3390 SecureWorks BRONZE UNION June 2017
T1003.002 Security Account Manager	GroupFIN13	FIN13 has extracted the SAM and SYSTEM registry hives using the `reg.exe` binary for obtaining password hashes from a compromised machine. Sygnia Elephant Beetle Jan 2022

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.