Esentutl /y /vss Used to Copy Live Registry Hive Files from System32\config

Duo Tech@duotech

•updated Jul 9, 2026•1•0•2

Detects the use of the built-in Windows utility esentutl.exe to copy sensitive registry hives (SAM, SECURITY, or SYSTEM). This is a known technique used by adversaries to perform offline credential dumping by accessing the registry hive files.