Security Account Manager (SAM)
MITRE ATT&CK, Credential Access, Sub-technique T1003.002
Last updated
MITRE ATT&CK, Credential Access, Sub-technique T1003.002
Last updated
The Security Accounts Manager (SAM) is a database file in Windows that contains usernames and passwords for local accounts, typically those identified from the net user command.
The SAM is a database file that contains local accounts for the host, typically those found with the net user command.
It is also possible to dump the SAM file via esentutl.exe which comes installed by default with Windows:
