Sensitive registry hive dump

Identifies an attempt to dump a sensitive registry hive (SAM, SECURITY, or SYSTEM). Adversaries dump these hives to extract cached credentials, LSA secrets, and the SAM database offline, commonly as a precursor to tools like secretsdump.py or mimikatz's lsadump module.

• Plataforma: Windows
• Severidad: High
• Táctica MITRE: Acceso a credenciales
• Técnicas MITRE: T1003, T1003.002

Volver a todas las reglas