SAM Hive Save to Non-Standard Path for Credential Dumping
Detects the use of reg.exe to save the HKLM\SAM registry hive to a file path outside of standard system directories. This behavior is indicative of credential dumping attempts, where adversaries attempt to bypass endpoint security behavioral detection rules that monitor for SAM file access in common locations by using alternative, potentially allowlisted paths.
Microsoft Sentinel (KQL)
