Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-Printer-SensitiveDocumentExfil.
Upgrade to ProDetect Data Exfiltration via Sensitive Document Printing in Splunk
Adversaries and malicious insiders may print sensitive documents to physically remove them from a facility as paper output, bypassing network-based DLP, email egress filtering, and removable-media controls entirely. This is a physical-medium exfiltration path distinct from USB transfer (T1052.001): the print spooler renders the document and a hard copy leaves the building in a pocket, bag, or folder with no file ever crossing the network egress boundary. Detection correlates Windows Print Service telemetry for bulk print volume, sensitive-keyword document names, and after-hours printing patterns that suggest deliberate physical removal of data rather than routine office printing.
MITRE ATT&CK
- Tactic
- Exfiltration
SPL Detection Query
index=wineventlog sourcetype="WinEventLog:Microsoft-Windows-PrintService/Operational" EventCode=307
| rex field=Message "Document \d+, (?<DocumentName>.*?), owned by (?<PrintUser>\S+) on"
| rex field=Message "was printed on (?<PrinterName>\S+) through"
| rex field=Message "Total pages printed:\s*(?<PageCount>\d+)"
| eval PageCount=if(isnull(PageCount), 1, PageCount)
| eval Hour=strftime(_time, "%H")
| eval IsSensitive=if(match(lower(DocumentName), "(confidential|restricted|nda|non-disclosure|merger|acquisition|payroll|salary|ssn|financials|source code|classified|proprietary|trade secret)"), 1, 0)
| eval IsAfterHours=if(Hour<6 OR Hour>=20, 1, 0)
| bucket _time span=1h
| stats
count as PrintJobCount,
sum(IsSensitive) as SensitiveJobCount,
sum(IsAfterHours) as AfterHoursJobCount,
sum(PageCount) as TotalPages,
values(DocumentName) as SampleDocuments,
values(PrinterName) as Printers,
earliest(_time) as FirstPrint,
latest(_time) as LastPrint
by _time, Computer, PrintUser
| where SensitiveJobCount > 0 OR TotalPages > 150 OR PrintJobCount > 25 OR AfterHoursJobCount > 0
| eval RiskScore=(SensitiveJobCount * 10) + (AfterHoursJobCount * 5) + (TotalPages / 10)
| eval RiskTier=case(
RiskScore >= 40, "Critical",
RiskScore >= 20, "High",
RiskScore >= 10, "Medium",
true(), "Low"
)
| sort - RiskScore
| table _time, Computer, PrintUser, PrintJobCount, SensitiveJobCount, AfterHoursJobCount, TotalPages, SampleDocuments, Printers, FirstPrint, LastPrint, RiskScore, RiskTierParses Windows Print Service Operational log Event ID 307 (document printed) via regex extraction of document name, printing user, printer, and page count from the event Message field. Buckets print activity into 1-hour windows per host/user and flags sensitive-keyword document names, high page/job volume, or after-hours printing (before 06:00 or after 20:00). Computes a cumulative risk score weighting sensitive-name matches and after-hours timing above raw volume, since combined signals more reliably indicate deliberate physical exfiltration than volume alone.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legal, HR, or finance staff printing large volumes of contracts, payroll reports, or financial statements as routine job duties
- Generic document names overlapping the sensitive-keyword list without actual sensitive content (e.g. blank NDA templates)
- Shift workers or employees in other time zones printing during what the rule treats as after-hours
- Scheduled overnight batch report generation through print-to-PDF virtual printers
Other platforms for THREAT-Printer-SensitiveDocumentExfil
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Bulk Print of Sensitive-Named Documents via PowerShell
Expected signal: Microsoft-Windows-PrintService/Operational Event ID 307 recorded 10 times within a short window, each RenderedDescription/Message containing a document name matching 'confidential_payroll_report_*' owned by the test user.
- Test 2High-Volume Print Job Outside Business Hours
Expected signal: Microsoft-Windows-PrintService/Operational Event ID 307 recorded with Total pages printed reflecting the multi-page document, timestamped outside the 06:00-20:00 window.
- Test 3Print Job with Sensitive Content but Innocuous File Name
Expected signal: Microsoft-Windows-PrintService/Operational Event ID 307 recorded for 'notes.txt' — document name carries no sensitive keyword despite sensitive content.
References (4)
- https://attack.mitre.org/techniques/T1052/
- https://learn.microsoft.com/en-us/troubleshoot/windows-server/printing/detailed-tracing-print-job-progress
- https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-rule-azure-monitor-agent
- https://www.papercut.com/products/ng/manual/common/topics/security-print-tracking.html
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-Printer-SensitiveDocumentExfil — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month