Credential dumping via reg.exe SAM save or ntds.dit access
Detects attempts to access or create copies of the Active Directory 'ntds.dit' database or the Windows Security Account Manager (SAM) registry hive using unauthorized processes. Attackers often target these files to extract credential hashes from Domain Controllers or local systems.
Microsoft Sentinel (KQL)
