SamDump implemented

documentation-payload/Cazalla/features.md

@@ -155,6 +155,9 @@ Cazalla automatically reports artifacts created during command execution, allowi
 | **Process Create** | `shell` | Command execution via cmd.exe |
 | **Process Create** | `inline_execute` | BOF execution in current process |
 | **Process Create** | `inline_execute_assembly` | .NET assembly execution in-process |
+| **Registry Read** | `samdump` | SAM database access (HKEY_LOCAL_MACHINE\SAM) |
+| **Registry Read** | `samdump` | SYSTEM hive access for boot key (HKEY_LOCAL_MACHINE\SYSTEM) |
+| **Credential Access** | `samdump` | SAM database enumeration and hash extraction |
 | **File Write** | `cp`, `mkdir`, `upload` | File creation or modification |
 | **File Delete** | `rm` | File or directory deletion |
 | **File Read** | `download` | File download operations |
@@ -503,6 +506,49 @@ browser_dump chrome
 
 For detailed information, see [browser_dump command documentation](commands/browser_dump.md).
 
+#### `samdump`
+
+Extracts NTLM password hashes from the Security Account Manager (SAM) database using multiple methods.
+
+**Extracted Data:**
+- NTLM hashes for all local user accounts
+- LM hashes (when available)
+- Relative Identifiers (RID) for each account
+
+**Methods:**
+1. **Registry** (default) - Direct registry access
+2. **Files** - From SAM/SYSTEM files on disk
+3. **Remote** - Remote registry access over network
+
+**Credential Reporting:**
+- **Hashes**: Automatically saved to Mythic's credential store as `hash` credential type
+- **Format**: `username:RID:LM:NTLM`
+- **Realm**: Empty (local accounts, no domain)
+- **Metadata**: Includes RID and LM hash information
+
+**OPSEC Considerations by Method:**
+
+- **Registry Method (CRITICAL)**: Direct SAM/SYSTEM registry access is heavily monitored, detection likely within minutes, requires SYSTEM privileges
+- **Files Method (MEDIUM-HIGH)**: Lower detection profile than registry, file access less aggressively monitored, useful for offline analysis
+- **Remote Method (HIGH)**: Network traffic detectable, service manipulation logged, authentication attempts logged, higher visibility
+
+**Examples:**
+```
+samdump                    # Registry method (default)
+samdump registry           # Registry method (explicit)
+samdump files C:\Windows\System32\config\SAM C:\Windows\System32\config\SYSTEM
+samdump remote \\TARGET-PC
+```
+
+**Best Practices:**
+- Always use `steal_token` on SYSTEM process first (for registry/files methods)
+- Choose method with lowest OPSEC risk for your situation
+- Files method preferred when you have offline files
+- Remote method only when local access not possible
+- Always requires approval from another operator
+
+For detailed information, see [samdump command documentation](commands/samdump.md).
+
 ---
 
 ## OPSEC Checking