Credential Theft: Expanding Your Reach, Pt. II

Huntress observed and documented a credential-theft technique in which adversaries abused the Windows LOLBin print.exe to copy AD credential stores (NTDS.DIT, SAM, SYSTEM) from Volume Shadow Copies; the report provides example command lines, notes use of NetTime.exe and vssuirun.exe, shows telemetry context across customer EDR data, and offers detection and mitigation guidance.