SAM-EXFIL: Credential Extraction via Raw NTFS Volume Reads

As red teamers regularly operating against mature Windows environments, we frequently encounter endpoint detection and response solutions that monitor access to Windows credential hive files at the AP