Sensitive registry hive dump

Identifies an attempt to dump a sensitive registry hive (SAM, SECURITY, or SYSTEM). Adversaries dump these hives to extract cached credentials, LSA secrets, and the SAM database offline, commonly as a precursor to tools like secretsdump.py or mimikatz's lsadump module.

Back to all rules