Abusing Print Executable

Title: Abusing Print Executable
Status: test
Description:Attackers can use print.exe for remote file copy
References:
  -https://lolbas-project.github.io/lolbas/Binaries/Print/
  -https://twitter.com/Oddvarmoe/status/985518877076541440
Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative
Date: 2020-10-05
modified:2022-07-07
Tags:

• -'attack.stealth'
• -'attack.t1218'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|endswith: '\print.exe'
    CommandLine|startswith: 'print'
    CommandLine|contains|all:
      -'/D'
      -'.exe'

  filter_print:
    CommandLine|contains: 'print.exe'
  condition:selection and not filter_print
Falsepositives:
  -Unknown
Level: medium