Printer Migration Command-Line Tool
PrintBrm -r -f C:\Users\user\Desktop\data.txt:hidden.zip -d C:\Users\user\Desktop\new_folder
Extract the contents of a ZIP file stored in an Alternate Data Stream (ADS) and store it in a folder
Decompress and extract a ZIP file stored on an alternate data stream to a new folder
C:\Windows\System32\spool\tools\PrintBrm.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/35a7244c62820fbc5a832e50b1e224ac3a1935da/rules/windows/process_creation/proc_creation_win_lolbin_printbrm.yml, IOC: PrintBrm.exe should not be run on a normal workstation
Elliot Killick (@elliotkillick)