Windows Print.EXE Sensitive File Dump for Credential Access
Alerts when Print.EXE is executed with arguments targeting ntds.dit, SAM, SECURITY, and SYSTEM files for credential access.
- Product
- windows
- Category
- process_creation
- Author
- Ayush Anand (Securityinbits) (SigmaHQ), DRL 1.1
- Published
- 2026-04-28
- Updated
- 2026-07-30
ATT&CK techniques
Defense Evasion → Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation events where Print.EXE is used to access sensitive Windows registry and database files for credential theft. It matches Print.EXE being launched and command-line arguments that include paths to ntds.dit as well as SAM, SECURITY, and SYSTEM configuration files. This behavior matters because copying these files enables offline credential extraction, either locally or via remote workflows.
Reporting behind it
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/
- huntress.comhttps://www.huntress.com/blog/credential-theft-expanding-your-reach-pt-2
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Binaries/Print/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_print_dump_sensitive_files.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Print.EXE Sensitive File Dump for Credential Access
id: 1d892425-7217-4a15-ac5b-9ac6e524f224
status: test
description: This rule flags process creation events where Print.EXE is used to access sensitive Windows registry and database files for credential theft. It matches Print.EXE being launched and command-line arguments that include paths to ntds.dit as well as SAM, SECURITY, and SYSTEM configuration files. This behavior matters because copying these files enables offline credential extraction, either locally or via remote workflows.
references:
- https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/
- https://www.huntress.com/blog/credential-theft-expanding-your-reach-pt-2
- https://lolbas-project.github.io/lolbas/Binaries/Print/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_print_dump_sensitive_files.yml
author: Ayush Anand (Securityinbits), Huntrule Team
date: 2026-04-28
tags:
- attack.credential-access
- attack.stealth
- attack.t1003.003
- attack.t1003.002
- attack.t1218
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \print.exe
- OriginalFileName: Print.EXE
selection_cli:
CommandLine|contains|windash: /D
CommandLine|contains:
- \config\SAM
- \config\SECURITY
- \config\SYSTEM
- \windows\ntds\ntds.dit
condition: all of selection_*
falsepositives:
- Unlikely
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_print_dump_sensitive_files/info.yml
license: DRL-1.1
related:
- id: 2fcda7e2-8c57-4904-86ac-37fc3157e09d
type: derived