Phoenix
Sigma IntelligenceBeta

Search rules

Search the full rule library from any page.

    Open navigation menuClose navigation menu
    All Authors
    AA

    Ayush Anand

    Securityinbits
    First rule: Tue Apr 28 2026 00:00:00 GMT+0000 (Coordinated Universal Time)
    Share profile card
    1rules authored
    Top Log Sources
    1
    windows / process_creation
    1 rules
    Rule Types
    detection
    1
    By Severity
    critical
    0
    high
    1
    medium
    0
    low
    0
    informational
    0
    By Status
    stable
    0
    test
    1
    experimental
    0
    deprecated
    0
    unsupported
    0
    1
    Total Rules
    0
    Stable Rules
    1
    High / Critical
    1
    Log Source Types
    Recent RulesAll rules →
    1 rulesInspect a rule without leaving your results.
    hightestDetection

    Sensitive File Dump Via Print.EXE

    Detects the abuse of the Print.exe utility for credential harvesting which involves using Print.Exe to copy sensitive files such as ntds.dit, SAM, SECURITY, or SYSTEM from the Windows directory in order to extract credentials, locally or remotely.

    windowsprocess_creation2 samples
    2026-04-28
    Browse all 1 rules by Ayush Anand
    Filter the full rule library to see only their contributions
    View Rules →