Query: write Sigma for Detects the abuse of the Print.exe utility for credential harvesting which involves using Print.Exe to copy sensitive fi
Matching passage: Sigma rule: Detects the abuse of the Print.exe utility for credential harvesting which involves using Print.Exe to copy sensitive fi. Logsource: windows / process_creation. Rule: title: Sensitive File Dump Via Print.EXE id: 2fcda7e2-8c57-4904-86ac-37fc3157e09d status: test description: 'Detects the abuse of the Print.exe utility for credential harvesting which involves using Print.Exe to copy sensitive files such as ntds.dit, SAM, SECURITY, or SYSTEM from the Windows directory in order to extract credentials, locally or remotely. ' references: - https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/ - https://www.huntress.com/blog/credential-theft-expanding-your-reach-pt-2 - https://lolbas-project.github.io/lolbas/Binaries/Print/ author: Ayush Anand (Securityinbits) date: 2026-04-28 tags: - attack.credential-access - attack.stealth - attack.t1003.003 - attack.t1003.002 - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \print.exe - OriginalFileName: Print.EXE selection_cli: CommandLine|contains|windash: /D CommandLine|contains: - \config\SAM - \config\SECURITY - \config\SYSTEM - \windows\ntds\ntds.dit condition: all of selection_* falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_print_dump_sensitive_files/info.yml
Near-miss passage: Sigma rule: Detects suspicious execution patterns where users are tricked into running malicious commands via clipboard manipulation. Logsource: windows / process_creation. Rule: title: Suspicious ClickFix/FileFix Execution Pattern id: d487ed4a-fd24-436d-a0b2-f4e95f7b2635 related: - id: f5fe36cf-f1ec-4c23-903d-09a3110f6bbb type: similar status: experimental description: 'Detects suspicious execution patterns where users are tricked into running malicious commands via clipboard manipulation, either through the Windows Run dialog (ClickFix) or File Explorer address bar (FileFix). Attackers leverage social engineering campaigns—such as fake CAPTCHA challenges or urgent alerts—encouraging victims to paste clipboard contents, often executing mshta.exe, powershell.exe, or similar commands to infect systems. ' references: - https://github.com/JohnHammond/recaptcha-phish - https://www.zscaler.com/blogs/security-research/deepseek-lure-using-captchas-spread-malware - https://www.threatdown.com/blog/clipboard-hijacker-tries-to-install-a-trojan/ - https://app.any.run/tasks/5c16b4db-4b36-4039-a0ed-9b09abff8be2 - https://www.esentire.com/security-advisories/netsupport-rat-clickfix-distribution - https://www.scpx.com.au/2025/11/16/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/ author: montysecurity, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-19 tags: - attack.execution - attack.t1204.001 - attack.t1204.004 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \explorer.exe CommandLine|contains: '#' selection_cli_captcha: CommandLine|contains: - account - anti-bot - botcheck - captcha - challenge - confirmation - fraud - human - identification - identificator - identity - robot - validation - verification - verify condition: all of selection_* falsepositives: - Unlikely level: high