Abusing Print.exe for Remote File Copy
This rule detects attempts to abuse the `print.exe` utility for remote file copy operations. Attackers can leverage `print.exe`, a legitimate Windows binary, to transfer files by specifying a remote destination using the `/D` switch and a file with an `.exe` extension. This technique is often used for defense evasion by proxying execution with a trusted system binary.
Sigma
