PrintBrm.exe ZIP Creation or Extraction
Detects the execution of the Windows LOLBIN (Living Off The Land Binary) PrintBrm.exe when it is used to create or extract ZIP files. This activity is generally not expected on a normal workstation and can indicate malicious use for data staging or exfiltration.
Sigma
