SAM registry hive dumped via reg save for credential theft
Detects the use of the native Windows registry utility 'reg.exe' to save or export the Security Account Manager (SAM) or SYSTEM registry hives to disk. This technique is a common precursor to credential theft, where attackers dump the SAM database to perform offline password cracking. This pattern has been observed in various adversary operations, including ransomware campaigns, to facilitate privilege escalation and lateral movement.
Microsoft Sentinel (KQL)
