Full Report
As with many tactics within the MITRE ATT&CK framework, credential theft consists of a number of different techniques. Showing what many of them look like on an endpoint helps other security professionals understand what to look for and how to detect and respond to similar activity.
Analysis Summary
# Tool/Technique: Credential Theft via Print.exe (LOLBin)
## Overview
This technique involves the abuse of the legitimate Windows utility `print.exe` to exfiltrate sensitive Active Directory and system credential files from Volume Shadow Copies (VSC). By using `print.exe` to "print" files to a local destination, attackers can bypass standard file-copy monitoring and avoid the typical artifacts left behind by traditional NTDS.dit extraction methods (such as `ntdsutil` or manual VSC mounting).
## Technical Details
- **Type:** Technique (Living off the Land / LOLBin)
- **Platform:** Windows (specifically Domain Controllers and Windows Servers)
- **Capabilities:** File exfiltration, Credential harvesting, Shadow Copy manipulation
- **First Seen:** April 2025 (as reported in this specific case study)
## MITRE ATT&CK Mapping
- **TA0006 - Credential Access**
- **T1003 - OS Credential Dumping**
- **T1003.002 - Security Account Manager**
- **T1003.003 - NTDS**
- **TA0005 - Defense Evasion**
- **T1218 - System Binary Proxy Execution**
## Functionality
### Core Capabilities
- **VSC Extraction:** Accesses files within Volume Shadow Copies using the `\\localhost\C$\@GMT-[Timestamp]` syntax.
- **File Exfiltration:** Redirects the "print" output of a sensitive file (like SAM, SYSTEM, or NTDS.dit) to a local file path using the `/D:` parameter.
- **Bypassing Detection:** Evades common detection signatures that look for `copy`, `xcopy`, or `powershell` based credential theft.
### Advanced Features
- **Temporal Alignment:** Use of `NetTime.exe` and `vssuirun.exe` to identify the exact timestamps and indices of available Volume Shadow Copies to target specific snapshots.
## Indicators of Compromise
- **File Names:**
- `saaas.i` (Observed temp file)
- `sysss.i` (Observed temp file)
- `NTDS.dit` (Target file)
- **Behavioral Indicators:**
- Execution of `NetTime.exe` or `vssuirun.exe` by unusual users.
- `print.exe` commands containing `/D:` followed by local paths and references to `@GMT` shadow copy paths.
- `print.exe` accessing `\windows\system32\config\SAM` or `\windows\NTDS\ntds.dit`.
## Associated Threat Actors
- **Unknown:** The specific actor was not named in the report, but the technique is linked to sophisticated actors targeting MSP environments and Active Directory databases.
## Detection Methods
- **Behavioral Detection:** Monitor `print.exe` for command-line arguments that point to the `\config\` directory or `.dit` files.
- **Process Lineage:** Alert on `print.exe` being spawned by suspicious parent processes or running on Domain Controllers where printing is not a standard administrative function.
- **Telemetry Analysis:** While `print.exe` is common (16,000+ legitimate hits in 24 hours), usage involving `\\localhost\C$\@GMT` is highly anomalous and should be flagged.
## Mitigation Strategies
- **Least Privilege:** Restrict administrative access to Domain Controllers to prevent the initiation of Volume Shadow Copies.
- **Attack Surface Reduction (ASR):** Implement rules to block process creations originating from suspicious LOLBins if they are not required for business operations.
- **Hardening:** Disable or restrict the VSS (Volume Shadow Copy) service on sensitive assets unless required for specific backup windows.
## Related Tools/Techniques
- **Esentutl.exe:** Another LOLBin used for copying locked credential databases.
- **Ntdsutil.exe:** The standard utility for Active Directory database maintenance often abused for credential dumping.
- **Volume Shadow Copy Service (VSS):** The underlying Windows feature exploited to access locked system files.