SAM Hive Access via offreg.dll Outside Registry Tools (PrettyPrague)

Amit Ambekar@Amit007

•updated Sep 2, 2026•2•0•5

This rule detects instances where a process loads 'offreg.dll' (Offline Registry Library) and concurrently accesses the SAM (Security Account Manager) file. This is a common technique used by attackers to offline-extract local account hashes without using standard registry tools, potentially bypassing basic monitoring of 'reg.exe'.