LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

PrintBrm.exe

View source

Printer Migration Command-Line Tool

DownloadADS
02COMMAND EXAMPLES
02ATT&CK TECHNIQUES
01DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Download1

EXAMPLE 01T1105

Create a ZIP file from a folder in a remote drive

COMMAND
PrintBrm -b -d {PATH_SMB:folder} -f {PATH_ABSOLUTE:.zip}
USE CASE
Exfiltrate the contents of a remote folder on a UNC share into a zip file
PRIVILEGES
User
OPERATING SYSTEM
Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Type · Compression

ADS1

EXAMPLE 01T1564.004

Extract the contents of a ZIP file stored in an Alternate Data Stream (ADS) and store it in a folder

COMMAND
PrintBrm -r -f {PATH_ABSOLUTE}:hidden.zip -d {PATH_ABSOLUTE:folder}
USE CASE
Decompress and extract a ZIP file stored on an alternate data stream to a new folder
PRIVILEGES
User
OPERATING SYSTEM
Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Type · Compression
02 / ON DISK

Known paths

C:\Windows\System32\spool\tools\PrintBrm.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    PrintBrm.exe should not be run on a normal workstation

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Elliot Killick@elliotkillick