Detection rules › Sigma

Sensitive File Dump Via Print.EXE

Status
test
Severity
high
Log source
product windows, category process_creation
Author
Ayush Anand (Securityinbits)
Source
github.com/SigmaHQ/sigma

Detects the abuse of the Print.exe utility for credential harvesting which involves using Print.Exe to copy sensitive files such as ntds.dit, SAM, SECURITY, or SYSTEM from the Windows directory in order to extract credentials, locally or remotely.

MITRE ATT&CK coverage

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: Sensitive File Dump Via Print.EXE
id: 2fcda7e2-8c57-4904-86ac-37fc3157e09d
status: test
description: |
    Detects the abuse of the Print.exe utility for credential harvesting which involves using Print.Exe to copy sensitive files such as ntds.dit, SAM, SECURITY, or SYSTEM from the Windows directory in order to extract credentials, locally or remotely.
references:
    - https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/
    - https://www.huntress.com/blog/credential-theft-expanding-your-reach-pt-2
    - https://lolbas-project.github.io/lolbas/Binaries/Print/
author: Ayush Anand (Securityinbits)
date: 2026-04-28
tags:
    - attack.credential-access
    - attack.stealth
    - attack.t1003.003
    - attack.t1003.002
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\print.exe'
        - OriginalFileName: 'Print.EXE'
    selection_cli:
        CommandLine|contains|windash: '/D'
        CommandLine|contains:
            - '\config\SAM'
            - '\config\SECURITY'
            - '\config\SYSTEM'
            - '\windows\ntds\ntds.dit'
    condition: all of selection_*
falsepositives:
    - Unlikely
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_print_dump_sensitive_files/info.yml

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_img

selection_img:
    - Image|endswith: '\print.exe'
    - OriginalFileName: 'Print.EXE'

Stage 2: selection_cli

selection_cli:
    CommandLine|contains|windash: '/D'
    CommandLine|contains:
        - '\config\SAM'
        - '\config\SECURITY'
        - '\config\SYSTEM'
        - '\windows\ntds\ntds.dit'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • /D transforms: windash corpus 4 (sigma 3, kusto 1)
  • \config\SAM corpus 4 (sigma 4)
  • \config\SECURITY corpus 4 (sigma 4)
  • \config\SYSTEM corpus 3 (sigma 3)
  • \windows\ntds\ntds.dit corpus 5 (sigma 5)
Imageends_with
  • \print.exe corpus 2 (sigma 2)
OriginalFileNameeq
  • Print.EXE