The SYSTEM hive is a Windows registry hive that stores system-wide configuration data, including boot settings and security-related keys. On a domain controller, it can contain the cryptographic material needed to decrypt protected parts of the Active Directory database offline. By itself, the hive is usually not the target; its value comes from pairing it with files such as ntds.dit.
This matters because attackers who copy both files may analyze domain credentials without logging in to the server. That can expose password hashes, Kerberos keys, and password-history data, turning a file theft into a domain-wide identity risk. Defenders treat domain controllers, backups, and snapshots as high-value assets and restrict access to any copy that includes the SYSTEM hive. Monitoring for unauthorized export, backup abuse, or snapshot extraction can help catch credential-dumping activity early.