Abuse of print.exe for Unauthorized File Transfer

The Windows native utility print.exe has been identified as a Living off the Land (LotL) binary that can be abused to perform unauthorized file copies. By utilizing specific command-line arguments, an attacker can coerce the print service into interacting with remote files, effectively bypassing traditional file-copy detection mechanisms that monitor standard tools like robocopy.exe or powershell.exe. This technique allows for the stealthy movement of executables or sensitive data from remote locations to a local system. Defenders should monitor for command-line patterns involving the print.exe utility that indicate remote connectivity rather than standard local printing operations, as this behavior is rarely observed in typical office environments.

Attack Chain

1. Attacker establishes initial access or presence on a target host.
2. Attacker stages a malicious executable on a remote network share or web server.
3. Attacker identifies print.exe as a permitted, signed binary on the target system.
4. Attacker executes print.exe via the command line, supplying the remote file path as an argument.
5. The utility triggers a request to the remote resource to pull the target file.
6. The remote file is copied to the local host filesystem.
7. Attacker executes the transferred file to achieve secondary payload delivery or data exfiltration.

Impact

Successful abuse of print.exe enables adversaries to download malicious payloads or stage data for exfiltration while evading simple endpoint security controls. While specific incident counts are not provided, the technique is widely recognized within the LOLBAS (Living Off the Land Binaries and Scripts) framework, which serves as a repository for binaries commonly exploited by threat actors across various sectors to maintain persistence and bypass security software.

Recommendation

• Deploy the provided Sigma rule to monitor for suspicious command-line invocations of print.exe.
• Enable Sysmon process-creation logging (Event ID 1) to capture the necessary Image and CommandLine fields.
• Review and baseline normal printing behavior in the environment to differentiate legitimate network printer interactions from malicious file transfers.
• Alert on or investigate any execution of print.exe that includes both the /D flag and references to non-printer related file extensions or remote paths.