Detect Data Exfiltration via Sensitive Document Printing in IBM QRadar
Adversaries and malicious insiders may print sensitive documents to physically remove them from a facility as paper output, bypassing network-based DLP, email egress filtering, and removable-media controls entirely. This is a physical-medium exfiltration path distinct from USB transfer (T1052.001): the print spooler renders the document and a hard copy leaves the building in a pocket, bag, or folder with no file ever crossing the network egress boundary. Detection correlates Windows Print Service telemetry for bulk print volume, sensitive-keyword document names, and after-hours printing patterns that suggest deliberate physical removal of data rather than routine office printing.
MITRE ATT&CK
- Tactic
- Exfiltration
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
"Computer" AS Hostname,
username AS UserName,
QIDNAME(qid) AS EventName,
"Message" AS PrintDetails,
COUNT(*) AS PrintJobCount
FROM events
WHERE
LOGSOURCETYPENAME(devicetype) ILIKE '%print%'
AND starttime > NOW() - 1 DAYS
AND qid IN (SELECT qid FROM QID WHERE name ILIKE '%printservice%' OR name ILIKE '%document printed%')
GROUP BY "Computer", username
HAVING COUNT(*) > 25
ORDER BY starttime DESCQRadar AQL query flagging hosts/users with more than 25 Print Service document-printed events (Event ID 307) within a 24-hour window. Intended to be paired with a separate custom property extraction rule parsing document name from the Message field to add sensitive-keyword matching for full T1052 physical-print exfiltration coverage.
Data Sources
Required Tables
False Positives & Tuning
- Legal, HR, or finance staff producing high print volume as routine job duties
- Print server or managed-print-service log sources generating one QRadar event per job at high baseline volume
- Departments with print-heavy workflows (mailroom, records management) exceeding the raw count threshold routinely
Other platforms for THREAT-Printer-SensitiveDocumentExfil
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Bulk Print of Sensitive-Named Documents via PowerShell
Expected signal: Microsoft-Windows-PrintService/Operational Event ID 307 recorded 10 times within a short window, each RenderedDescription/Message containing a document name matching 'confidential_payroll_report_*' owned by the test user.
- Test 2High-Volume Print Job Outside Business Hours
Expected signal: Microsoft-Windows-PrintService/Operational Event ID 307 recorded with Total pages printed reflecting the multi-page document, timestamped outside the 06:00-20:00 window.
- Test 3Print Job with Sensitive Content but Innocuous File Name
Expected signal: Microsoft-Windows-PrintService/Operational Event ID 307 recorded for 'notes.txt' — document name carries no sensitive keyword despite sensitive content.
References (4)
- https://attack.mitre.org/techniques/T1052/
- https://learn.microsoft.com/en-us/troubleshoot/windows-server/printing/detailed-tracing-print-job-progress
- https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-rule-azure-monitor-agent
- https://www.papercut.com/products/ng/manual/common/topics/security-print-tracking.html
Response Playbook
Triage
- Retrieve the full Print Service Operational log entry (Event ID 307) for the flagged job(s) — confirm the exact document name, printing user, printer name/port, byte size, and total page count rather than relying on the summarized alert fields
- Determine whether the user has a documented business justification for printing the flagged document(s) — check if the role (legal, HR, finance, executive assistant) routinely handles this document type
- Identify the physical printer used — confirm it is a corporate-managed device in a monitored area versus a personal/home printer reachable over VPN, or a printer in a low-traffic/isolated part of the building
- Check whether the print job occurred immediately after the user accessed the source file from a sensitive file share, mailbox attachment, or SharePoint/OneDrive location — correlate with DeviceFileEvents/OfficeActivity access logs in the preceding 30 minutes
- Review the user's badge access and physical presence at the time of printing — confirm they were on-site and had the opportunity to physically collect the printed output
- Assess whether the user is a departing employee, one on a performance improvement plan, or otherwise flagged in a prior insider-risk review, which materially raises the priority of this alert
Containment
- If the user is a departing or terminated employee, immediately suspend badge access and account credentials to prevent further printing or facility access
- Coordinate with facilities/security to review whether the printed output can still be recovered from the printer output tray, a shared print queue, or a follow-me/pull-printing release station before the user leaves the premises
- Apply printer usage restrictions (print quota, watermarking, or managed-print-service approval workflows) for the account pending investigation
- If document management/DLP tooling supports print-blocking policies (e.g., Microsoft Purview print restrictions, print watermarking), apply a temporary block on the user or document classification
- Escalate to HR/Legal immediately if insider threat is suspected — do not confront the employee directly without HR/Legal involvement, to avoid tipping off a bad-faith actor or mishandling a wrongful accusation
Evidence Collection
- Windows Print Service Operational log (Event IDs 307, 805, 842) — full print job history including document name, user, printer, byte size, and page count
- Print server spooler files (if follow-me/pull printing or print server auditing retains rendered job data) for the specific job IDs in question
- Source file access logs (DeviceFileEvents, OfficeActivity, SharePoint/OneDrive audit logs) for the 30-60 minutes preceding the print event, to establish where the document originated
- Badge/physical access control logs correlating the user's building/floor access with the timestamp of the print job
- CCTV footage near the printer location, if available and permitted by policy, covering the print job timestamp
- Managed print service (e.g., PaperCut, Papercut MF, Pull Print / Follow-Me Printing) audit trail, if deployed, which often retains a rendered copy or thumbnail of the printed document for a retention period
Escalation Criteria
- !Document names or content confirmed to contain financial records, source code, M&A/legal materials, PII/PHI, or credentials/security documentation
- !The user is a departing employee, a contractor near contract end, or previously flagged in an insider risk review
- !Printing occurred outside normal business hours or from an account not typically associated with high-volume or sensitive printing
- !The print job immediately followed access to a sensitive file share, mailbox, or repository the user does not normally use
- !Multiple large or sensitive print jobs occur across several days culminating shortly before a resignation, termination notice, or scheduled last day
- !The printed output cannot be located in the output tray or pull-print queue, suggesting it was collected and removed
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Windows Event Log: Microsoft-Windows-PrintService/Operational Event IDs 307 (document printed), 805 (job deleted), 842 (job printed with errors) — full job metadata including document name, owner, printer, and page/byte counts - >
Windows Event Log: Microsoft-Windows-PrintService/Admin — printer configuration and driver installation events - >
Print spooler files: `C:\Windows\System32\spool\PRINTERS\*.SPL` and `*.SHD` — may retain rendered job data briefly if a job was held or failed before completion - >
Managed print service audit logs (PaperCut, Equitrac, or similar pull-print solutions) — often retain a thumbnail/rendered copy of print jobs and card-release/authentication events at the physical device - >
Application-level 'recently printed' artifacts: Microsoft Office MRU/jump lists, Adobe Reader print history, and Windows Recent Items referencing the source document - >
Badge access control system logs correlating physical presence with print job timestamps
Tuning Guidance
Printer-based exfiltration detection depends entirely on the Print Service Operational log being forwarded to the SIEM — confirm the Microsoft-Windows-PrintService/Operational channel is enabled (it is disabled by default on many builds) and included in the Azure Monitor Agent Data Collection Rule or Windows Event Forwarding subscription before relying on this detection. Build a per-department printing baseline before enabling the volume-based thresholds broadly: legal, HR, and finance teams routinely produce high page counts and should either be excluded or given a substantially higher threshold. Maintain the sensitive-keyword list against your organization's actual document classification/DLP labels rather than the generic example terms, and prefer combining keyword matches with after-hours timing or user risk context over either signal alone, since keyword-only matching on file names has a high false-positive rate. Where a managed print/pull-print service (PaperCut, Equitrac) is deployed, prefer its audit trail over raw PrintService events — it typically provides authenticated release-at-device confirmation, closing the gap between 'a job was queued' and 'a human physically collected the paper.'
Hunting Queries
Baseline hunt for users with unusually high cumulative print volume over a 30-day period — establishes a per-user printing baseline so future volume-based alerts can be tuned to each role rather than a single global threshold.
Event
| where TimeGenerated > ago(30d)
| where Source == "Microsoft-Windows-PrintService" and EventID == 307
| extend PrintUser = extract(@"owned by ([^\s]+) on", 1, RenderedDescription)
| summarize JobCount=count() by PrintUser
| where JobCount > 200
| sort by JobCount descindex=wineventlog sourcetype="WinEventLog:Microsoft-Windows-PrintService/Operational" EventCode=307
| rex field=Message "owned by (?<PrintUser>\S+) on"
| stats count as JobCount by PrintUser
| where JobCount > 200
| sort - JobCountHunt for users with repeated after-hours print activity across a 7-day window, independent of document naming — surfaces printing patterns inconsistent with normal working hours that warrant a look regardless of whether keyword matching fired.
Event
| where TimeGenerated > ago(7d)
| where Source == "Microsoft-Windows-PrintService" and EventID == 307
| extend PrintUser = extract(@"owned by ([^\s]+) on", 1, RenderedDescription)
| extend HourOfDay = hourofday(TimeGenerated)
| where HourOfDay < 6 or HourOfDay >= 20
| summarize AfterHoursJobs=count() by PrintUser, bin(TimeGenerated, 1d)
| where AfterHoursJobs > 5
| sort by AfterHoursJobs descindex=wineventlog sourcetype="WinEventLog:Microsoft-Windows-PrintService/Operational" EventCode=307
| rex field=Message "owned by (?<PrintUser>\S+) on"
| eval Hour=strftime(_time, "%H")
| where Hour<6 OR Hour>=20
| bucket _time span=1d
| stats count as AfterHoursJobs by PrintUser, _time
| where AfterHoursJobs > 5
| sort - AfterHoursJobsAtomic Red Team Tests
Simulates an insider printing a batch of documents whose file names contain sensitive keywords, exercising the sensitive-keyword and job-count detection paths. Uses the built-in Microsoft Print to PDF virtual printer so the test can run without physical printer hardware, since Print to PDF still generates standard Print Service Operational log events.
Command
powershell.exe -Command "New-Item -ItemType Directory -Path 'C:\Temp\PrintTest' -Force | Out-Null; 1..10 | ForEach-Object { $f = \"C:\Temp\PrintTest\confidential_payroll_report_$_.txt\"; Set-Content -Path $f -Value 'test payroll data'; Start-Process -FilePath notepad.exe -ArgumentList \"/p `\"$f`\"\" -Wait }"Cleanup
powershell.exe -Command "Remove-Item -Path 'C:\Temp\PrintTest' -Recurse -Force -ErrorAction SilentlyContinue"Expected Telemetry
Microsoft-Windows-PrintService/Operational Event ID 307 recorded 10 times within a short window, each RenderedDescription/Message containing a document name matching 'confidential_payroll_report_*' owned by the test user.
Expected Detection
KQL: SensitiveJobCount >= 10 in the 1-hour bin for the test user/host, driving ExfiltrationRisk to Critical or High. SPL: sum(IsSensitive) reflects the same count, producing RiskScore >= 40 (Critical tier).
Simulates a large, non-sensitively-named print job (e.g., a routine-looking report) submitted late at night, exercising the after-hours and page-volume detection paths independent of keyword matching. Requires the test to be run (or the event timestamp reviewed) outside the configured business-hours window (before 06:00 or after 20:00 local time).
Command
powershell.exe -Command "$content = (1..300 | ForEach-Object { \"Line $_ of quarterly summary report\" }) -join \"`n\"; Set-Content -Path 'C:\Temp\quarterly_summary.txt' -Value $content; Start-Process -FilePath notepad.exe -ArgumentList '/p \"C:\Temp\quarterly_summary.txt\"' -Wait"Cleanup
powershell.exe -Command "Remove-Item -Path 'C:\Temp\quarterly_summary.txt' -Force -ErrorAction SilentlyContinue"Expected Telemetry
Microsoft-Windows-PrintService/Operational Event ID 307 recorded with Total pages printed reflecting the multi-page document, timestamped outside the 06:00-20:00 window.
Expected Detection
KQL: AfterHoursJobCount > 0 for the hourly bin, combined with TotalPages > 150 pushing the summarized row past the alert threshold even with SensitiveJobCount = 0. SPL: IsAfterHours=1 and TotalPages contribute to RiskScore crossing the High/Critical band.
Simulates a scenario where the document file name is deliberately generic (evading keyword-based detection) but the underlying content is sensitive — useful for validating that the detection's volume/after-hours signals still surface activity that keyword matching alone would miss, and for documenting the coverage gap in the tuning guidance.
Command
powershell.exe -Command "Set-Content -Path 'C:\Temp\notes.txt' -Value 'employee SSNs and salary data'; Start-Process -FilePath notepad.exe -ArgumentList '/p \"C:\Temp\notes.txt\"' -Wait"Cleanup
powershell.exe -Command "Remove-Item -Path 'C:\Temp\notes.txt' -Force -ErrorAction SilentlyContinue"Expected Telemetry
Microsoft-Windows-PrintService/Operational Event ID 307 recorded for 'notes.txt' — document name carries no sensitive keyword despite sensitive content.
Expected Detection
Neither the KQL nor SPL rule fires on keyword matching for this job in isolation (IsSensitiveName/IsSensitive = 0), confirming the documented coverage gap: file-name-based keyword matching cannot see message body content and must be supplemented by DLP content inspection or volume/after-hours correlation for full coverage.