SAM Registry Hive

Location

Description

Security Accounts Manager hive containing local user accounts, group memberships, password policy settings, and NTLM password hashes.

Forensic Value

Enumerating local accounts reveals rogue admin accounts created for persistence. Comparing last password change timestamps against known compromise windows identifies accounts likely tampered with by adversaries. Extracted NTLM hashes (with SYSTEM hive as decryption key) confirm whether pass-the-hash was feasible.

Tools Required

Collection Commands

kape.exe --tsource C: --tdest C:\output --target RegistryHives

reg save HKLM\SAM C:\output\SAM.hiv

python3 secretsdump.py -sam SAM.hiv -system SYSTEM.hiv LOCAL

rip.exe -r C:\output\SAM.hiv -p samparse

Collection Constraints

• •Availability, retention, and field coverage depend on the Windows release, SKU, per-host audit policy, and user activity. Treat absence as inconclusive unless you verified the feature was enabled.

MITRE ATT&CK Techniques

References