SAM Hive Dump via Registry Save Command

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects attempts to dump the Security Account Manager (SAM) hive using the 'reg save' command over HTTP. Specifically, it looks for HTTP requests containing 'reg save' and 'HKLM\SAM' in the URI, indicating an attempt to extract credential information from a Windows system.