SAMDUMP

Summary from the TLDR InfoSec newsletter

This tool extracts offline Windows SAM, SYSTEM, and SECURITY registry hives and parses them to extract hashed credentials for analysis. It's intended for use by red-team or forensic practitioners to recover NTLM/LM hashes for further brute force or audit activities. Infosec professionals should treat any accessible hives as a high-risk indicator, ensure live system backup integrity, enforce privilege separation for hive access, and validate detection around unusual hive reads or exfiltration.