Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Printer-SensitiveDocumentExfil.
Upgrade to ProDetect Data Exfiltration via Sensitive Document Printing in Microsoft Sentinel
Adversaries and malicious insiders may print sensitive documents to physically remove them from a facility as paper output, bypassing network-based DLP, email egress filtering, and removable-media controls entirely. This is a physical-medium exfiltration path distinct from USB transfer (T1052.001): the print spooler renders the document and a hard copy leaves the building in a pocket, bag, or folder with no file ever crossing the network egress boundary. Detection correlates Windows Print Service telemetry for bulk print volume, sensitive-keyword document names, and after-hours printing patterns that suggest deliberate physical removal of data rather than routine office printing.
MITRE ATT&CK
- Tactic
- Exfiltration
KQL Detection Query
let SensitiveKeywords = dynamic(["confidential", "restricted", "nda", "non-disclosure", "merger", "acquisition", "payroll", "salary", "ssn", "financials", "source code", "classified", "proprietary", "trade secret"]);
// Windows Print Service Operational log (Event ID 307 = document printed) forwarded to the Event table
Event
| where TimeGenerated > ago(24h)
| where Source == "Microsoft-Windows-PrintService" and EventID == 307
| extend DocumentName = extract(@"Document \d+, (.*?), owned by", 1, RenderedDescription)
| extend PrintUser = extract(@"owned by ([^\s]+) on", 1, RenderedDescription)
| extend PrinterName = extract(@"was printed on ([^\s]+) through", 1, RenderedDescription)
| extend PageCount = toint(extract(@"Total pages printed: (\d+)", 1, RenderedDescription))
| extend HourOfDay = hourofday(TimeGenerated)
| where isnotempty(DocumentName)
| extend IsSensitiveName = DocumentName has_any (SensitiveKeywords)
| extend IsAfterHours = HourOfDay < 6 or HourOfDay >= 20
| summarize
PrintJobCount = count(),
SensitiveJobCount = countif(IsSensitiveName),
AfterHoursJobCount = countif(IsAfterHours),
TotalPages = sum(PageCount),
SampleDocuments = make_set(DocumentName, 10),
Printers = make_set(PrinterName, 5),
FirstPrint = min(TimeGenerated),
LastPrint = max(TimeGenerated)
by Computer, PrintUser, bin(TimeGenerated, 1h)
| where SensitiveJobCount > 0 or TotalPages > 150 or PrintJobCount > 25 or AfterHoursJobCount > 0
| extend ExfiltrationRisk = case(
SensitiveJobCount > 3 and AfterHoursJobCount > 0, "Critical",
SensitiveJobCount > 0 or (AfterHoursJobCount > 0 and TotalPages > 50), "High",
TotalPages > 150 or PrintJobCount > 25, "Medium",
"Low"
)
| project TimeGenerated, Computer, PrintUser, PrintJobCount, SensitiveJobCount, AfterHoursJobCount, TotalPages, SampleDocuments, Printers, FirstPrint, LastPrint, ExfiltrationRisk
| sort by TotalPages descDetects potential physical exfiltration via printing by parsing Windows Print Service Operational log Event ID 307 (document printed) forwarded into the Sentinel Event table. Extracts document name, printing user, printer, and page count from the rendered event description, then flags hourly windows per user where documents contain sensitive keywords (confidential, payroll, source code, etc.), where a large total page volume or job count is printed, or where printing occurs outside business hours (before 06:00 or after 20:00 local time). Assigns a risk tier combining sensitive-name matches with after-hours timing, since either signal alone has a much higher false-positive rate than the combination. Requires the Print Service Operational log forwarded via Azure Monitor Agent DCR (Channel: Microsoft-Windows-PrintService/Operational) or Windows Event Forwarding.
Data Sources
Required Tables
False Positives & Tuning
- Legal, HR, or finance staff routinely printing large volumes of contracts, payroll reports, or financial statements as part of normal job duties
- Print job names containing generic words that overlap the sensitive-keyword list (e.g. a template file named 'NDA_blank_form.docx') without any actual sensitive content
- Employees on early or late shifts, or in different time zones than the SOC baseline, printing during what the rule considers after-hours
- Bulk printing of onboarding packets, training materials, or all-hands handouts that produce a high page/job count in a short window
- Print server or print-to-PDF virtual printers used for automated report generation batch jobs that run overnight on a schedule
Other platforms for THREAT-Printer-SensitiveDocumentExfil
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Bulk Print of Sensitive-Named Documents via PowerShell
Expected signal: Microsoft-Windows-PrintService/Operational Event ID 307 recorded 10 times within a short window, each RenderedDescription/Message containing a document name matching 'confidential_payroll_report_*' owned by the test user.
- Test 2High-Volume Print Job Outside Business Hours
Expected signal: Microsoft-Windows-PrintService/Operational Event ID 307 recorded with Total pages printed reflecting the multi-page document, timestamped outside the 06:00-20:00 window.
- Test 3Print Job with Sensitive Content but Innocuous File Name
Expected signal: Microsoft-Windows-PrintService/Operational Event ID 307 recorded for 'notes.txt' — document name carries no sensitive keyword despite sensitive content.
References (4)
- https://attack.mitre.org/techniques/T1052/
- https://learn.microsoft.com/en-us/troubleshoot/windows-server/printing/detailed-tracing-print-job-progress
- https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-rule-azure-monitor-agent
- https://www.papercut.com/products/ng/manual/common/topics/security-print-tracking.html
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Printer-SensitiveDocumentExfil — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month