Registry Hive Theft via VSS Symlink and Local Copy

Ankit Mehta@Secvyn

•updated Sep 24, 2026•0•0•1

Detects a sequence of suspicious activities associated with credential dumping and inhibiting system recovery. The rule tracks when a user account executes multiple commands related to volume shadow copies (vssadmin, rmdir, mklink) or attempts to copy sensitive registry files (SAM, SYSTEM, SECURITY) within a 15-minute window on the same device.