Windows: PrintBrm.exe ZIP Creation/Extraction via Command-Line Flags

title: "Windows: PrintBrm.exe ZIP Creation/Extraction via Command-Line Flags"
id: ab730970-a50e-471f-8ce3-ad91335ce2d6
status: test
description: This rule identifies execution of PrintBrm.exe with command-line arguments that include the flag '-f' and a '.zip' target, indicating ZIP creation or extraction behavior. Attackers can use this signed utility to package or unpack files in a way that blends into normal Windows activity. The detection relies on Windows process creation telemetry, matching the process image ending in '\PrintBrm.exe' and the presence of specific substrings in the command line.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/PrintBrm/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_printbrm.yml
author: frack113, Huntrule Team
date: 2022-05-02
tags:
  - attack.command-and-control
  - attack.stealth
  - attack.t1105
  - attack.t1564.004
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: \PrintBrm.exe
    CommandLine|contains|all:
      - " -f"
      - .zip
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: cafeeba3-01da-4ab4-b6c4-a31b1d9730c7
    type: derived