Generic Vss Hive Credential Dumper

Collin Lairamore@Bollinmore

•updated Apr 27, 2026•0•144

PE capability indicators for VSS + raw-NTFS + regf hive credential dumping (T1003.002). Catches tools that dynamically resolve APIs via GetProcAddress and construct device paths at runtime. If used to scan disk, expect a small number of tools that legitimately edit hives, most can be tunned with the optional pe-suppression block inside the rule is enabled.