
title: Typical HiveNightmare SAM File Export
author: Florian Roth
date: 2021/07/23
description: Detects files written by the different tools that exploit HiveNightmare
detection:
  SELECTION_1:
    EventID: 11
  SELECTION_2:
    TargetFilename:
    - '*\hive_sam_*'
    - '*\SAM-2021-*'
    - '*\SAM-2022-*'
    - '*\SAM-haxx*'
    - '*\Sam.save*'
  SELECTION_3:
    TargetFilename:
    - C:\windows\temp\sam
  condition: (SELECTION_1 and (SELECTION_2 or SELECTION_3))
falsepositives:
- Files that accidentally contain these strings
fields:
- CommandLine
- ParentCommandLine
id: 6ea858a8-ba71-4a12-b2cc-5d83312404c7
level: high
logsource:
  category: file_event
  product: windows
references:
- https://github.com/GossiTheDog/HiveNightmare
- https://github.com/FireFart/hivenightmare/
- https://github.com/WiredPulse/Invoke-HiveNightmare
- https://twitter.com/cube0x0/status/1418920190759378944
status: experimental
tags:
- attack.credential_access
- attack.t1552.001
- cve.2021.36934
ruletype: SIGMA
