Field Notes: From AV Alert to Impacket

What it is

A DFIR walkthrough turning a single Microsoft Defender alert (Behavior:Win32/RegDump.SA, User SYSTEM, Process svchost.exe) into an Impacket-style remote SAM-hive dump, using the MFT as the pivot. Its value is the concrete hunting artifacts, not the narrative.

How it works

Impacket's RemoteOperations saves a registry hive remotely via the Windows Remote Registry service, talking to the winreg RPC interface over MS-RRP through the SMB named pipe \pipe\winreg. Because the save is performed by the legitimate service, endpoint telemetry attributes it to svchost.exe running as SYSTEM — not to python.exe or any attacker binary. The temp filename is generated as eight randomly chosen ASCII letters plus .tmp:

tmpFileName = ''.join(
    [random.choice(string.ascii_letters) for _ in range(8)]
) + '.tmp'

Note ascii_letters — letters only, no digits — a tighter pattern than "random ASCII." Impacket's RemoteFile.close() normally deletes the file afterward; here a partial hive (ASOWCIKI.tmp) survived, likely because Defender interrupted the dump.

What to hunt

• Files in C:\Windows\Temp\ matching [A-Za-z]{8}\.tmp whose contents begin with the regf signature (a Windows registry hive) — a saved/partial SAM hive.
• Behavior:Win32/RegDump.SA attributed to svchost.exe as SYSTEM; treat the alerting process as the service, not the attacker's tool or source host.
• SMB access to the \pipe\winreg named pipe.
• SCM Event ID 7040 showing the Remote Registry service changing from disabled to demand-start — observed in a Huntress case (April 2026) with the same RegDump.SA + svchost.exe + random .tmp (aRhRnnHI.tmp) combination.

flowchart TD
    A[Defender: RegDump.SA on svchost.exe/SYSTEM] --> B[MFT pivot around timestamp]
    B --> C{Temp file<br/>8 letters + .tmp?}
    C -->|regf signature = SAM hive| D[Impacket RemoteOperations dump]
    C -->|no| E[Different vector]
    D --> F[Corroborate: Event 7040<br/>+ \pipe\winreg SMB]

Caveats

The page is explicit: the artifact does not prove the standalone secretsdump.py was run — many offensive tools reuse or embed Impacket code, so it only confirms an Impacket-style RemoteOperations workflow. The "Defender interrupted the save" explanation for the leftover partial hive is stated as one plausible theory, not proven.