PrintBrm ZIP Creation of Extraction

calendar Aug 12, 2024 · attack.command-and-control attack.t1105 attack.defense-evasion attack.t1564.004  ·
Share on: linkedin copy

Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should not be run on a normal workstation.

Sigma rule (View on GitHub)

 1title: PrintBrm ZIP Creation of Extraction
 2id: cafeeba3-01da-4ab4-b6c4-a31b1d9730c7
 3status: test
 4description: Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should not be run on a normal workstation.
 5references:
 6    - https://lolbas-project.github.io/lolbas/Binaries/PrintBrm/
 7author: frack113
 8date: 2022-05-02
 9tags:
10    - attack.command-and-control
11    - attack.t1105
12    - attack.defense-evasion
13    - attack.t1564.004
14logsource:
15    product: windows
16    category: process_creation
17detection:
18    selection:
19        Image|endswith: '\PrintBrm.exe'
20        CommandLine|contains|all:
21            - ' -f'
22            - '.zip'
23    condition: selection
24falsepositives:
25    - Unknown
26level: high

References

  • Printbrm on LOLBAS

    PrintBrm.exe is a living-of-the-land file containing unexpected functionality that can be abused by attackers; this page lists all its use cases.


    Read More

Related rules

to-top