Identifier / Programs / Windows

print.exe

Sends a text file to a printer. Windows commands reference

LOLBAS ADS, Copy 2 Sigma rules name it 5 ATT&CK techniques 3 documented commands 13 known copies with hashes

How print.exe is abused

documented by LOLBAS

ADS T1564.004 Hide Artifacts: NTFS File Attributes

/dSpecifies the printer that you want to print the job. Windows commands reference

Copy T1105 Ingress Tool Transfer

/dSpecifies the printer that you want to print the job. Windows commands reference

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for print.exe.

3 documented commands

from LOLBAS, each read by the identifier

ADS T1564.004 Hide Artifacts: NTFS File Attributes User privileges

Copy file.exe into the Alternate Data Stream (ADS) of file.txt.

print /D:{PATH_ABSOLUTE}:file.exe {PATH_ABSOLUTE:.exe}

Identify

Trips 1 Sigma rule: mediumAbusing Print Executable by Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative

Copy T1105 Ingress Tool Transfer User privileges

Copy file from source to destination

print /D:{PATH_ABSOLUTE:.dest.exe} {PATH_ABSOLUTE:.source.exe}

Identify

Trips 1 Sigma rule: mediumAbusing Print Executable by Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative

Copy T1105 Ingress Tool Transfer User privileges

Copy File.exe from a network share to the target c:\OutFolder\outfile.exe.

print /D:{PATH_ABSOLUTE:.dest.exe} {PATH_SMB:.source.exe}

Identify

Trips 1 Sigma rule: mediumAbusing Print Executable by Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative

All 3 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for print.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for print.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

highSensitive File Dump Via Print.EXEAyush Anand (Securityinbits)

mediumAbusing Print ExecutableFurkan CALISKAN, @caliskanfurkan_, @oscd_initiative

T1003.002OS Credential Dumping: Security Account Manager

T1003.003OS Credential Dumping: NTDS

T1105Ingress Tool Transfer

T1218System Binary Proxy Execution

T1564.004Hide Artifacts: NTFS File Attributes

Is it the real print.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
C:\program files\GIMP 2\lib\gimp\2.0\plug-ins\print\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionPrint Utility

13 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\print.exe · signed by Microsoft Windows

18ad33ea5179fe8a7defb775303b70feb6841ddb5e5d0ec41749112a55b74ddd

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\print.exe · signed by Microsoft Windows

dfa124ae202a2a3f758cd4b9fdb5eeb2eeaee0f7827fe81675524da93176e7e8

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\print.exe · signed by Microsoft Windows

388d6761e678c66eeda7085a05e10b13abf88f855b753300c0f9b0d94ddb4db0

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\print.exe · signed by Microsoft Windows

76cd31a70770af4ff2db5f84f174d9740d2fe6603628bc07d6689e60edff5935

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\print.exe · signed by Microsoft Windows

3a30d8e24ce0306ce442235c4d60423cea3ba5369b744afc384d502d97cfaa6a

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\print.exe · signed by Microsoft Windows

ee6f8bbde72bde2e7b28e80370c61e6adc4789103ee6c94b9584a0190c0f71a7

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\print.exe · signed by Microsoft Windows

16c7c773bf7cb099132d30d1ed5160d10918db0101f5cc3d4d197e1e4d0d4cca

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\print.exe · signed by Microsoft Windows

9eb93fbde0a661888a0ace44906dc7da3872fe610a348cafa81e56f8b8ea4975

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\print.exe · signed by Microsoft Windows

a936f6b1eea36876aa26cb02b3e52270f1361de77847adb170121c83385aa77e

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\print.exe · signed by Microsoft Windows

daaa0966cce2cead029755024e0fefb64a9832de845d125f9efc5b3abf25e315

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\print.exe · not signed

a6420218d7a95b6b598646691c563d4f220f7c60610092195072e5fb6c96c869

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\print.exe · not signed

ab5e21c17a4ea0d66f826657ed714c2db0880a0a19ade61abb92dacc3acfbc28

2.10.20.0 · C:\program files\GIMP 2\lib\gimp\2.0\plug-ins\print\print.exe · signed by Jernej Simoni

652d9f7456fe61bfce664de8b372be2a6eac217c707326ffe432301db014682e

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

Everyday use

from tldr-pages, CC BY 4.0

View documentation for the Zsh builtin

tldr print.zshIdentify

View documentation for the print alias of run-mailcap --action=print

tldr --platform linux run-mailcapIdentify

View documentation for printing text files on Windows

tldr --platform windows print.winIdentify

None of the 3 examples the identifier reads matches LOLBAS abuse or trips a Sigma process-creation rule.

Options

2 in Windows commands reference

Show every option of print.exe

/dSpecifies the printer that you want to print the job.

/?Displays help at the command prompt.

print.exe

How print.exe is abused

3 documented commands

What detects it

Is it the real print.exe?

13 known copies

Everyday use

Options

Other programs abused for ADS