Sensitive registry hive dump
Identifies an attempt to dump a sensitive registry hive (SAM, SECURITY, or SYSTEM). Adversaries dump these hives to extract cached credentials, LSA secrets, and the SAM database offline, commonly as a precursor to tools like secretsdump.py or mimikatz's lsadump module.
- Platform: Windows
- Severity: High
- MITRE Tactic: Credential Access
- MITRE Techniques: T1003, T1003.002