In a scenario where an attacker got access to a host that is being monitored and protected by an EDR, the attacker will aim to dump the SAM and Security registries which contain hashes for the local users and system secrets like: bootkey or DPAPI keys, but the EDR will prevent the attacker from doing that, we will have a look at another way of dumping them without the EDR preventing us, but before I’ll put a brief explanation about the SAM, SYSTEM and SECURITY registries:
What is SAM registry?
A registry is a local database the exist in every Windows system, the SAM registry contains hashed passwords for the local users In the machine
What is Security registry?
Security registry stores the Lsass policy database; this database contains local system security policy settings which controls, among:
• which domains are trusted to authenticate logon attempts
• which users are allowed to access the system
• on what channels these users are allowed to access the system (interactive, network, service logons)
• which privileges are assigned to a user
• how users are audited
• logon information for cached domain logons and service logons
What is System registry?
It is a shared database of extremely complex and convoluted objects and elements. It also contains the keys and info needed to decrypt the data inside the SAM and System registries
Technical Aspects
The typical and well-known way of dumping the registries is by using the reg.exe built-in binary, which after some time of using it EDRs started blocking it as shown
The method I’ll be using is by utilizing the registry editor, which a software that is installed by default on windows hosts that allows you to view and edit the registries in the system
Right click on one of them then export:
Make sure to change the file type in “Safe as type” to Registry Hive Files, as It is the type ours tools can interact with; the files will look like the this after exporting:
You will then need to move the files to another machine to use our tools on them, where we will be utilizing secretsdump to export the secrets from
This is what dumping the local users hashes from the SAM registry will look like:
And this is what dumping the LSA secrets from the Security registry will look like:
“SEC” “SAM” “SYS” will be the file names for the registries on the device
Conclusion
Although Endpoint Detection and Response (EDR) solutions have advanced in their ability to detect and block common techniques like using reg.exe to dump the SAM, SYSTEM, and SECURITY registries, attackers can still find alternative methods to bypass these protections. By leveraging the built-in registry editor, attackers can export these registries as Registry Hive Files without triggering EDR alerts. Once exported and moved to an external machine, tools like secretsdump can be used to extract sensitive data such as hashed passwords and system secrets.
This highlights the importance of defense-in-depth strategies, ensuring that multiple layers of security are in place beyond EDR solutions to detect and prevent such attacks. Regular monitoring, network segmentation, and proactive security hygiene can help mitigate the risk of credential theft and unauthorized access, even if one layer of defense is bypassed
