Rule Info
Name
Sensitive File Dump Via Print.EXE
Author
Ayush Anand (Securityinbits)
Description
Detects the abuse of the Print.exe utility for credential harvesting which involves using Print.Exe to copy sensitive files such as ntds.dit, SAM, SECURITY, or SYSTEM from the Windows directory in order to extract credentials, locally or remotely.
Date
2026-04-28 00:00:00
Modified
None
Id
2fcda7e2-8c57-4904-86ac-37fc3157e09d
Tags
attack.credential-access attack.stealth attack.t1003.003 attack.t1003.002 attack.t1218
Type
Community Rule
Link to Public Repo
Scan your endpoints, forensic images or collected files with our portable scanner THOR