PrintBrm.exe ZIP File Creation or Extraction
Detects the execution of the Windows LOLBIN (Living Off the Land Binary) PrintBrm.exe with command-line arguments indicating the creation or extraction of ZIP files. This activity is considered suspicious on a normal workstation as PrintBrm.exe is typically used for printer migration and not for general file archiving.
YARA-L
