Credential Dumping via Reg Save or Impacket
Detects attempts to dump credentials using 'reg save HKLM\SAM' command or the 'impacket-secretsdump' tool. These methods are commonly used by adversaries to extract password hashes from the Security Account Manager (SAM) database or other credential stores for offline cracking or reuse.
Microsoft Sentinel (KQL)
