CVE-2021-36934

What it actually does

CVE-2021-36934, commonly referred to as the Windows SAM local privilege escalation issue, is caused by overly permissive Access Control Lists on sensitive Windows system database files under %windir%\System32\config, including SAM, SYSTEM, and SECURITY. A low-privileged local user or code already running on the host can read these files, often via Volume Shadow Copy snapshots, extract local account password hashes and system secrets, and use them to escalate privileges or execute code as NT AUTHORITY\SYSTEM. The flaw affects Windows 10 1809, 1909, 2004, 20H2, and 21H1. Because existing shadow copies may retain vulnerable permissions, patching alone does not fully remove exposure unless vulnerable shadow copies are deleted.

Why it matters to the business

Successful exploitation can turn an initial low-privilege foothold into full administrative control of a Windows endpoint. This enables attackers to dump credentials, create privileged accounts, disable security tooling, deploy malware, move laterally, and access or destroy data. The vulnerability is in CISA KEV with active exploitation observed in the wild, and the KEV remediation due date was 2022-02-24, so any remaining exposure should be treated as overdue and high priority. Since this issue affects common Windows 10 versions, organizations may have broad endpoint exposure, especially on systems with Volume Shadow Copies or restore points created before remediation.

How an attack unfolds

An attacker first gains the ability to run code as a standard local user, such as through phishing, malware execution, exploitation of another application, or misuse of an existing account. The attacker checks whether sensitive registry hive files such as SAM, SYSTEM, and SECURITY are readable directly or through existing Volume Shadow Copies. If accessible, the attacker copies those hives from %windir%\System32\config or from paths such as \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy*\Windows\System32\config\. The attacker then extracts local password hashes, LSA secrets, cached credentials, or other authentication material using tools such as Mimikatz, Impacket secretsdump, or offline registry parsing utilities. With those secrets, the attacker can authenticate as or impersonate privileged local users, perform pass-the-hash activity, create or modify administrator accounts, or launch a process as SYSTEM. Once elevated, the attacker may disable defenses, establish persistence, collect additional credentials, and move laterally to other systems.

How to fix it

Apply the relevant Microsoft Windows security cumulative update for all affected Windows 10 versions and ensure systems are on a supported, fully patched build. Patching corrects the improper ACLs going forward, but it does not remove vulnerable copies already stored in Volume Shadow Copies. After patching, restrict access to the registry hive directory by running an elevated command such as: icacls %windir%\system32\config\*.* /inheritance:e. Then delete existing Volume Shadow Copies and restore points that may contain exposed SAM, SYSTEM, or SECURITY files, following Microsoft guidance in KB5005357. Common administrative approaches include vssadmin delete shadows /for=%systemdrive% /Quiet, wbadmin delete catalog, or using System Protection settings, but organizations should validate backup and restore requirements before deletion. Recreate clean restore points only after the ACLs have been corrected. Where immediate patching is not possible, restrict local interactive access, monitor and block untrusted execution, prevent standard users from reading sensitive hive files, and increase monitoring for hive-copying and credential-dumping behavior.

How to confirm the fix worked

Confirm the operating system is patched with a cumulative update that includes Microsoft’s fix for this issue. Validate ACLs on %windir%\System32\config\SAM, SYSTEM, and SECURITY and ensure non-administrative users cannot read these files. A practical check is to run icacls %windir%\system32\config\SAM, icacls %windir%\system32\config\SYSTEM, and icacls %windir%\system32\config\SECURITY and confirm BUILTIN\Users or low-privileged principals do not have inappropriate read access. Verify that old Volume Shadow Copies created before remediation have been deleted by running vssadmin list shadows or equivalent enterprise inventory checks. Attempt validation from a standard user context: direct copying of SAM, SYSTEM, and SECURITY from both the live config directory and any shadow copy path should fail. Confirm a new restore point, if required, was created only after ACL correction.

Typical attack path

1. Obtain local code execution on an affected Windows 10 system as a low-privileged user.
2. Enumerate ACLs on %windir%\System32\config\SAM, SYSTEM, SECURITY, or related registry hive files.
3. Identify usable Volume Shadow Copy snapshots containing readable copies of the registry hives.
4. Copy SAM, SYSTEM, and SECURITY hives from the live filesystem or from \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy* paths.
5. Extract local password hashes, cached credentials, LSA secrets, or boot keys from the copied hives.
6. Use recovered secrets for local privilege escalation, pass-the-hash, credential reuse, or SYSTEM-level execution.
7. Perform post-exploitation actions such as persistence, defense evasion, credential dumping, lateral movement, or data access.

How to detect it

To determine whether this was already exploited, review endpoint telemetry and Windows logs for suspicious access to registry hive files, Volume Shadow Copy enumeration, and credential extraction. Key sources include EDR process/file telemetry, Windows Security Event ID 4688 process creation logs, Sysmon Event ID 1 process creation, Sysmon Event ID 11 file creation, Sysmon Event ID 23/26 file deletion where available, PowerShell logs Event ID 4103 and 4104, WMI-Activity Event ID 5857/5861, and Microsoft-Windows-TaskScheduler logs for suspicious follow-on persistence. Look for low-privileged users running commands that list or copy shadow copies, including vssadmin list shadows, wmic shadowcopy, Get-WmiObject Win32_ShadowCopy, mklink to GLOBALROOT shadow paths, or copying SAM/SYSTEM/SECURITY hives. Search for creation of files named SAM, SYSTEM, SECURITY, sam.save, system.save, security.save, or compressed archives containing those names outside %windir%\System32\config. Investigate execution of credential-dumping tools or commands such as mimikatz, sekurlsa, lsadump, impacket-secretsdump, pwdump, reg save HKLM\SAM, reg save HKLM\SYSTEM, and reg save HKLM\SECURITY. Review local account changes, including Security Event IDs 4720, 4722, 4732, 4738, and 4672, and correlate with suspicious hive access. Also investigate pass-the-hash or lateral movement indicators after suspected exploitation, including unusual NTLM logons, remote service creation, scheduled task creation, PsExec-like activity, and administrative SMB access from endpoints that should not initiate such connections.

• %windir%\System32\config\SAM
• %windir%\System32\config\SYSTEM
• %windir%\System32\config\SECURITY
• C:\Windows\System32\config\SAM
• C:\Windows\System32\config\SYSTEM
• C:\Windows\System32\config\SECURITY
• \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy
• HarddiskVolumeShadowCopy
• \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy*\Windows\System32\config\SAM
• \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy*\Windows\System32\config\SYSTEM
• \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy*\Windows\System32\config\SECURITY
• vssadmin list shadows
• vssadmin delete shadows
• wmic shadowcopy list
• wmic shadowcopy get
• Get-WmiObject Win32_ShadowCopy
• Get-CimInstance Win32_ShadowCopy
• mklink /d
• reg save HKLM\SAM
• reg save HKLM\SYSTEM
• reg save HKLM\SECURITY
• reg.exe save HKLM\SAM
• reg.exe save HKLM\SYSTEM
• reg.exe save HKLM\SECURITY
• copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy
• xcopy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy
• robocopy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy
• icacls %windir%\system32\config
• icacls C:\Windows\System32\config
• sam.save
• system.save
• security.save
• mimikatz.exe
• sekurlsa::logonpasswords
• lsadump::sam
• lsadump::secrets
• secretsdump.py
• impacket-secretsdump
• pwdump.exe

What your security team should do

• Treat remaining exposure as urgent because the vulnerability is in CISA KEV and has been actively exploited in the wild.
• Patch all affected Windows 10 1809, 1909, 2004, 20H2, and 21H1 systems or upgrade them to supported fully patched releases.
• Do not stop at patching: delete pre-remediation Volume Shadow Copies and restore points that may still expose SAM, SYSTEM, and SECURITY hives.
• Run enterprise-wide checks for vulnerable ACLs on %windir%\System32\config and for hosts with old shadow copies.
• Hunt for prior exploitation using process creation, PowerShell, Sysmon, EDR, file access, and shadow copy activity logs.
• Prioritize investigation of systems where low-privileged users executed vssadmin, wmic shadowcopy, reg save, icacls, copy, xcopy, robocopy, certutil, Mimikatz, or Impacket-style credential dumping activity.
• Reset or rotate credentials for local administrator accounts and any accounts whose hashes or cached credentials may have been exposed on compromised hosts.
• Ensure local administrator passwords are unique per host using a managed local admin password solution.
• Restrict local logon and code execution rights on workstations and servers to reduce the likelihood of local exploitation.
• Increase detection coverage for registry hive access, shadow copy enumeration, credential dumping tools, pass-the-hash behavior, and new local administrator account creation.