{
  "family": "libsam",
  "sample_count": 1,
  "category": "advanced_threat",
  "description": "<h3>Executive Summary</h3>\nLibsam (often a component of or detected alongside tools like `pwdump` or `gsecdump`) is a classification for a HackTool library designed specifically to interact with and extract the Security Account Manager (SAM) database from Windows operating systems. When found on a corporate endpoint outside of authorized penetration testing, it is a critical indicator of post-compromise activity and impending credential theft.\n\n<h3>Technical Capabilities and Abuse</h3>\nLibsam itself is typically a Dynamic Link Library (`.dll`) utilized by a larger credential dumping framework. Threat actors deploy these tools *after* they have already achieved local Administrator or SYSTEM privileges on a compromised machine.\n\nIts primary function is the circumvention of OS protections to facilitate hash extraction:\n<ul>\n<li><strong>SAM Database Interaction:</strong> The Windows SAM file stores user passwords in a hashed format (LM/NTLM). Normally, the OS locks this file while Windows is running. Libsam provides the low-level API calls necessary for a dumping tool to bypass this lock.</li>\n<li><strong>Injection and Extraction:</strong> The tool utilizing Libsam often injects into the Local Security Authority Subsystem Service (`lsass.exe`) process or utilizes specialized drivers to dump the hashes directly from memory or the registry without needing to read the physical SAM file on disk.</li>\n<li><strong>Facilitating Lateral Movement:</strong> The extracted NTLM hashes are then exfiltrated. Attackers can use them in offline cracking attacks (using Hashcat) or directly in \"Pass-the-Hash\" attacks to authenticate to other servers and pivot laterally across the Active Directory domain.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe unauthorized presence of Libsam (or associated credential dumping utilities) on a system is a critical security emergency. It unequivocally indicates that an attacker has achieved elevated privileges and is actively attempting to steal domain credentials to facilitate widespread lateral movement.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Isolation:</strong> Isolate the compromised machine immediately to prevent the attacker from exfiltrating the dumped hashes or using them to pivot to the Domain Controller.</li>\n<li><strong>Enterprise-Wide Credential Reset:</strong> If the tool executed successfully, incident responders must assume that all local accounts (and potentially cached domain accounts) on that machine are compromised. A mandatory password reset must be enforced.</li>\n<li><strong>Hunt for the Initial Access Vector:</strong> Libsam is a post-exploitation tool. The investigation must focus on *how* the attacker gained the administrative privileges necessary to deploy it in the first place (e.g., exploiting a vulnerable service, phishing a privileged user, or lateral movement from another host).</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "HackTool.Libsam",
    "Riskware.Pwdump.Lib",
    "Win32/Libsam"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1003.002",
    "T1003.001",
    "T1550.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T17:40:52Z",
  "type": "HackTool / Credential Dumper Component",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}