NTDS.dit Theft Attempt via Print Utility

Akshay Gaikwad@AkshayGaikwwad

•updated Feb 10, 2026•3•0•95

Detects attempts to access or exfiltrate the Active Directory database (NTDS.dit) using the 'print.exe' utility. This specific technique was observed in post-exploitation activities following the compromise of SolarWinds Web Help Desk servers.