Name:SAM Database File Access Attempt id:57551656-ebdb-11eb-afdf-acde48001122 version:4 date:2024-10-17 author:Michael Haag, Mauricio Velazco, Splunk status:production type:Hunting Description:The following analytic detects attempts to access the SAM, SYSTEM, or SECURITY database files within the `windows\system32\config` directory using Windows Security EventCode 4663. This detection leverages Windows Security Event logs to identify unauthorized access attempts. Monitoring this activity is crucial as it indicates potential credential access attempts, possibly exploiting vulnerabilities like CVE-2021-36934. If confirmed malicious, an attacker could extract user passwords, leading to unauthorized access, privilege escalation, and further compromise of the system. Data_source:
-Windows Event Log Security 4663
search:`wineventlog_security` (EventCode=4663) ProcessName!=*\\dllhost.exe ObjectName IN ("*\\Windows\\System32\\config\\SAM*","*\\Windows\\System32\\config\\SYSTEM*","*\\Windows\\System32\\config\\SECURITY*") | stats values(AccessList) count by ProcessName ObjectName dest src_user | rename ProcessName as process_name | `sam_database_file_access_attempt_filter`
how_to_implement:To successfully implement this search, you must ingest Windows Security Event logs and track event code 4663. For 4663, enable "Audit Object Access" in Group Policy. Then check the two boxes listed for both "Success" and "Failure." known_false_positives:Natively, `dllhost.exe` will access the files. Every environment will have additional native processes that do as well. Filter by process_name. As an aside, one can remove process_name entirely and add `Object_Name=*ShadowCopy*`. References: -https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4663 -https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4663 -https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934 -https://github.com/GossiTheDog/HiveNightmare -https://github.com/JumpsecLabs/Guidance-Advice/tree/main/SAM_Permissions -https://en.wikipedia.org/wiki/Security_Account_Manager drilldown_searches:
: tags: analytic_story: - 'Credential Dumping' - 'Graceful Wipe Out Attack' - 'Rhysida Ransomware' asset_type:Endpoint confidence:100 cve: - 'CVE-2021-36934' impact:80 message:The following process $process_name$ accessed the object $ObjectName$ attempting to gain access to credentials on $dest$ by user $src_user$. mitre_attack_id: - 'T1003.002' - 'T1003' observable: name:'src_user' type:'User' - role: - 'Victim' name:'dest' type:'Hostname' - role: - 'Victim' name:'process_name' type:'Process' - role: - 'Attacker' name:'ObjectName' type:'File' - role: - 'Attacker' product: - 'Splunk Enterprise' - 'Splunk Enterprise Security' - 'Splunk Cloud' required_fields: - '_time' - 'process_name' - 'Object_Name' - 'dest' - 'user' risk_score:80 security_domain:endpoint
