{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/sam-hive/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["credential-access","powershell","windows","sam-hive"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eAdversaries frequently target the Windows Security Account Manager (SAM) registry hive to harvest local account password hashes. By leveraging Volume Shadow Copies (VSS), attackers bypass file system locks that typically prevent direct access to the SAM database while the operating system is running. PowerShell is commonly used to programmatically locate the path of the SAM file within a mounted shadow copy and execute copy operations to a staging directory. This technique is a critical component of credential access, as it enables offline cracking of NTLM hashes. Defenders should focus on detecting the combined usage of volume shadow copy paths and file-copying cmdlets or .NET file API calls within PowerShell processes, as these actions are rarely performed by legitimate administrative tasks.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains elevated (administrative or SYSTEM) privileges on the target Windows host.\u003c/li\u003e\n\u003cli\u003eAttacker interacts with the Volume Shadow Copy Service (VSS) via 'vssadmin' or WMI to create a snapshot of the C: drive.\u003c/li\u003e\n\u003cli\u003eAttacker identifies the path to the mounted snapshot, typically starting with 'HarddiskVolumeShadowCopy'.\u003c/li\u003e\n\u003cli\u003eAttacker launches a PowerShell process to target the SAM file at '\\HarddiskVolumeShadowCopy[N]\\Windows\\System32\\config\\sam'.\u003c/li\u003e\n\u003cli\u003eAttacker executes copy commands ('Copy-Item', 'cp', or .NET 'System.IO.File::Copy') to extract the SAM hive to a staging folder (e.g., C:\\Windows\\Temp).\u003c/li\u003e\n\u003cli\u003eAttacker potentially repeats the process for the SYSTEM and SECURITY hives to facilitate credential decryption.\u003c/li\u003e\n\u003cli\u003eAttacker exfiltrates the hives or decrypts them locally to obtain cleartext credentials or NTLM hashes.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exfiltration of the SAM hive allows attackers to perform offline brute-force or dictionary attacks against local account password hashes. If a system contains accounts with cached credentials or local administrative accounts with weak passwords, this technique frequently leads to privilege escalation and horizontal movement across the domain environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eDeploy the provided Sigma rule to detect suspicious PowerShell execution patterns involving shadow copy paths. Ensure Sysmon or native Windows Event ID 4688 (Process Creation) with Command Line logging is enabled. Monitor for 'vssadmin.exe' creation followed by PowerShell file access patterns targeting 'sam' or 'system' registry hives. Block or restrict the use of PowerShell for sensitive file system operations in high-security zones where such behavior is non-standard.\u003c/p\u003e\n","date_modified":"2026-09-03T12:41:25Z","date_published":"2026-09-03T12:41:25Z","id":"https://feed.craftedsignal.io/briefs/2026-09-powershell-sam-access/","summary":"Adversaries utilize PowerShell to copy the Security Account Manager (SAM) registry hive from shadow copies for offline credential extraction.","title":"PowerShell SAM Registry Hive Exfiltration","url":"https://feed.craftedsignal.io/briefs/2026-09-powershell-sam-access/"}],"language":"en","title":"CraftedSignal Threat Feed - Sam-Hive","version":"https://jsonfeed.org/version/1.1"}