STAC4713 NTDS.dit Theft via VSS vssuirun.exe and Print Command Exfil

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•6

Detects potential credential dumping activity targeting sensitive files like NTDS.dit, SAM, and SYSTEM hives. This rule monitors for three primary indicators: unauthorized invocation of vssuirun.exe (often used for Volume Shadow Copy manipulation), exploitation of print command utilities to access sensitive system files, and the staging of critical credential files into temporary directory paths.