SAM Registry Hive Handle Request

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•22

Detects attempts to request a handle to the Security Account Manager (SAM) registry hive. Accessing the SAM hive can indicate an adversary attempting to dump credentials.