Used by Windows to send files to the printer Located at: C:\Windows\System32\print.exe; C:\Windows\SysWOW64\print.exe.
printprintSandbox: execFile · Timeout: 30s
system.file.alternate-data-stream system.file.copy Outputs
process.output Command execution output
filesystem_write Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Copy file.exe into the Alternate Data Stream (ADS) of file.txt. (Hide binary file in alternate data stream to potentially bypass defensive counter measures)
print /D:{PATH_ABSOLUTE}:file.exe {PATH_ABSOLUTE:.exe}Copy file from source to destination (Copy files)
print /D:{PATH_ABSOLUTE:.dest.exe} {PATH_ABSOLUTE:.source.exe}Copy File.exe from a network share to the target c:\OutFolder\outfile.exe. (Copy/Download file from remote server)
print /D:{PATH_ABSOLUTE:.dest.exe} {PATH_SMB:.source.exe}| Type | Rule / Indicator |
|---|---|
| sigma | https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_print_remote_file_copy.yml |
| ioc | Print.exe retrieving files from internet |
| ioc | Print.exe creating executable files on disk |
print is a Windows LOLBin. Used by Windows to send files to the printer Located at: C:\Windows\System32\print.exe; C:\Windows\SysWOW64\print.exe.