PrintBrm ZIP Creation of Extraction (cafeeba3-01da-4ab4-b6c4-a31b1d9730c7)

Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should not be run on a normal workstation.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
PrintBrm ZIP Creation of Extraction (cafeeba3-01da-4ab4-b6c4-a31b1d9730c7)	Sigma-Rules	Ingress Tool Transfer - T1105 (e6919abc-99f9-4c6c-95a5-14761e7b2add)	Attack Pattern	1
PrintBrm ZIP Creation of Extraction (cafeeba3-01da-4ab4-b6c4-a31b1d9730c7)	Sigma-Rules	NTFS File Attributes - T1564.004 (f2857333-11d4-45bf-b064-2c28d8525be5)	Attack Pattern	1
NTFS File Attributes - T1564.004 (f2857333-11d4-45bf-b064-2c28d8525be5)	Attack Pattern	Hide Artifacts - T1564 (22905430-4901-4c2a-84f6-98243cb173f8)	Attack Pattern	2