PrintBrm ZIP Creation of Extraction

Title: PrintBrm ZIP Creation of Extraction
Status: test
Description:Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should not be run on a normal workstation.
References:
  -https://lolbas-project.github.io/lolbas/Binaries/PrintBrm/
Author: frack113
Date: 2022-05-02
modified:None
Tags:

• -'attack.command-and-control'
• -'attack.stealth'
• -'attack.t1105'
• -'attack.t1564.004'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection:
    Image|endswith: '\PrintBrm.exe'
    CommandLine|contains|all:
      -' -f'
      -'.zip'

  condition:selection
Falsepositives:
  -Unknown
Level: high