Potential Credential Dumping via Command Line Keywords

Ankit Mehta@Secvyn

•updated Jun 13, 2026•0•0•7

This rule detects the execution of processes where the command line contains keywords commonly associated with credential dumping activities, specifically targeting NTUser.dat, SAM, or SYSTEM files. These files often contain sensitive credential information that attackers attempt to extract.