Potential SAM Database Dump

SigmaHQ Detections@sigmaHQ

•updated Sep 13, 2024•0•0•0

Detects the creation of files that look like exports of the local SAM (Security Account Manager)