Used by Windows to send files to the printer
print /D:C:\ADS\File.txt:file.exe C:\ADS\File.exe
Copy file.exe into the Alternate Data Stream (ADS) of file.txt.
Hide binary file in alternate data stream to potentially bypass defensive counter measures
C:\Windows\System32\print.exe, C:\Windows\SysWOW64\print.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_print_remote_file_copy.yml, IOC: Print.exe retrieving files from internet, IOC: Print.exe creating executable files on disk
Oddvar Moe (@oddvarmoe)