Windows Print.EXE Sensitive File Dump for Credential Access

title: Windows Print.EXE Sensitive File Dump for Credential Access
id: 1d892425-7217-4a15-ac5b-9ac6e524f224
status: test
description: This rule flags process creation events where Print.EXE is used to access sensitive Windows registry and database files for credential theft. It matches Print.EXE being launched and command-line arguments that include paths to ntds.dit as well as SAM, SECURITY, and SYSTEM configuration files. This behavior matters because copying these files enables offline credential extraction, either locally or via remote workflows.
references:
  - https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/
  - https://www.huntress.com/blog/credential-theft-expanding-your-reach-pt-2
  - https://lolbas-project.github.io/lolbas/Binaries/Print/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_print_dump_sensitive_files.yml
author: Ayush Anand (Securityinbits), Huntrule Team
date: 2026-04-28
tags:
  - attack.credential-access
  - attack.stealth
  - attack.t1003.003
  - attack.t1003.002
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \print.exe
    - OriginalFileName: Print.EXE
  selection_cli:
    CommandLine|contains|windash: /D
    CommandLine|contains:
      - \config\SAM
      - \config\SECURITY
      - \config\SYSTEM
      - \windows\ntds\ntds.dit
  condition: all of selection_*
falsepositives:
  - Unlikely
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_print_dump_sensitive_files/info.yml
license: DRL-1.1
related:
  - id: 2fcda7e2-8c57-4904-86ac-37fc3157e09d
    type: derived