SamDump implemented

documentation-payload/Cazalla/opsec.md

@@ -81,6 +81,10 @@ These commands are **highly detectable** and require careful consideration:
 | `steal_token` | HIGH | High (EDR/XDR monitoring) | `make_token` when credentials available |
 | `rm` (system files) | HIGH | Blocked for safety | Never delete system files |
 | `screenshot` | HIGH | Screen capture detection | Use sparingly, consider timing |
+| `samdump` (registry) | CRITICAL | Very High (direct SAM access) | Requires SYSTEM privileges, heavily monitored, detection within minutes |
+| `samdump` (files) | MEDIUM-HIGH | Medium-High (file access) | Lower detection profile, useful for offline analysis |
+| `samdump` (remote) | HIGH | High (network traffic + registry) | Network traffic detectable, service manipulation logged |
+| `browser_dump` | HIGH | High (browser credential access) | Browser credential access is heavily monitored |
 
 ### 🟡 MEDIUM OPSEC RISK
 
@@ -373,6 +377,31 @@ Built-in Cazalla commands:
 - **Detection**: Browser credential access is heavily monitored by EDR/XDR
 - **Best Practice**: Use only when necessary, always requires approval, consider timing
 
+#### `samdump`
+
+The `samdump` command supports three methods with different OPSEC profiles:
+
+**Registry Method (Default):**
+- **Risk**: CRITICAL
+- **Detection**: Direct SAM/SYSTEM registry access is heavily monitored by EDR/XDR solutions
+- **Detection Timeframe**: Likely within minutes
+- **Best Practice**: Requires SYSTEM privileges (use `steal_token` on SYSTEM process first), always requires approval, consider timing, highest detection risk
+- **Alternatives**: Use files method for lower detection profile, or Mimikatz via `inline_execute_assembly` for different detection signatures
+
+**Files Method:**
+- **Risk**: MEDIUM-HIGH
+- **Detection**: File access and RegLoadKey operations are monitored but less aggressively than direct registry access
+- **Detection Timeframe**: Medium-High (hours to days)
+- **Best Practice**: Lower detection profile than registry method, still requires SYSTEM or backup/restore privileges, useful for offline analysis of backup files
+- **Use Case**: When you have access to SAM/SYSTEM files from backups or offline systems
+
+**Remote Method:**
+- **Risk**: HIGH
+- **Detection**: Network traffic (RPC calls), service manipulation (Remote Registry), and remote registry access are monitored
+- **Detection Timeframe**: High (minutes to hours)
+- **Best Practice**: Network traffic is detectable, authentication attempts are logged, use only when local access is not possible, higher visibility due to network activity
+- **Use Case**: When you need to dump SAM from a remote system over the network
+
 #### `screenshot`
 - **Risk**: HIGH
 - **Detection**: Screen capture detection, behavioral analysis