PrintBrm.exe

Commands

1. DownloadUser T1105

   Exfiltrate the contents of a remote folder on a UNC share into a zip file

   PrintBrm -b -d {PATH_SMB:folder} -f {PATH_ABSOLUTE:.zip}

   Create a ZIP file from a folder in a remote drive

   os: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

   Type: Compression

2. ADSUser T1564.004

   Decompress and extract a ZIP file stored on an alternate data stream to a new folder

   PrintBrm -r -f {PATH_ABSOLUTE}:hidden.zip -d {PATH_ABSOLUTE:folder}

   Extract the contents of a ZIP file stored in an Alternate Data Stream (ADS) and store it in a folder

   os: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

   Type: Compression

Detection

• Sigma https://github.com/SigmaHQ/sigma/blob/35a7244c62820fbc5a832e50b1e224ac3a1935da/rules/windows/process_creation/proc_creation_win_lolbin_printbrm.yml
• IOCPrintBrm.exe should not be run on a normal workstation

Resources

• https://twitter.com/elliotkillick/status/1404117015447670800