Copying the password hives and the AD database
Password hashes live in files an attacker with administrator rights can copy: the SAM and SECURITY registry hives on any machine, and NTDS.dit on a domain controller. The copy is made with built-in tools so that no obvious hacking program runs: reg save, esentutl with a volume shadow copy, ntdsutil, and vssadmin to make the shadow copy. The recordings have six such commands across several machines. Other recordings on the same machines disable event logging; those are not what this challenge asks for. Find the six copy commands.
Hint 1
reg.exe runs for many reasons; the hive copy is reg save of HKLM\SAM, HKLM\SECURITY or HKLM\SYSTEM to a file.
Hint 2
esentutl, ntdsutil and vssadmin are the other tools here. vssadmin create shadow makes the shadow copy that esentutl then reads.
The rule runs in this browser; it is saved here so you can come back to it.
Events
2,262 events. Search filters the table; it does not affect the result.