{"id":"cafeeba3-01da-4ab4-b6c4-a31b1d9730c7","title":"PrintBrm ZIP Creation of Extraction","description":"Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should not be run on a normal workstation.","author":"frack113","status":"test","level":"high","date":"2022-05-02","modified":"","tags":["attack.command-and-control","attack.stealth","attack.t1105","attack.t1564.004"],"technique_ids":["T1105","T1564.004"],"logsource":{"product":"windows","category":"process_creation"},"falsepositives":["Unknown"],"references":["https://lolbas-project.github.io/lolbas/Binaries/PrintBrm/"],"source_path":"rules/windows/process_creation/proc_creation_win_lolbin_printbrm.yml","source_sha256":"efbea052bf037ecdaac18ef9da23bb125b9a2ba096bc108b0e19b2fcb7edb0b5","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lolbin_printbrm.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: PrintBrm ZIP Creation of Extraction\nid: cafeeba3-01da-4ab4-b6c4-a31b1d9730c7\nstatus: test\ndescription: Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should not be run on a normal workstation.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/PrintBrm/\nauthor: frack113\ndate: 2022-05-02\ntags:\n    - attack.command-and-control\n    - attack.stealth\n    - attack.t1105\n    - attack.t1564.004\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection:\n        Image|endswith: '\\PrintBrm.exe'\n        CommandLine|contains|all:\n            - ' -f'\n            - '.zip'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1105","id":"T1105","name":"Ingress Tool Transfer","page":"techniques/enterprise/T1105/"},{"key":"enterprise/T1564.004","id":"T1564.004","name":"NTFS File Attributes","page":"techniques/enterprise/T1564.004/"}],"data_path":"data/detection-rules/cafeeba3-01da-4ab4-b6c4-a31b1d9730c7.json","kind":"sigma"}