QuarksDumpLocalHash SAM registry hive access for local hash extraction

Ethan Andrews@eandrews

•updated Jul 16, 2026•3•0•5

Detects execution of QuarksDumpLocalHash, a tool used to extract local account password hashes directly from the SAM registry hive. This activity is indicative of credential dumping for offline password cracking.