Added print lolbin

rules/windows/process_creation/win_susp_print.yml

@@ -0,0 +1,28 @@
+title: Abusing Print Executable
+id: bafac3d6-7de9-4dd9-8874-4a1194b493ed
+description: Attackers can use print.exe for remote file copy                   
+author: 'Furkan CALISKAN, @caliskanfurkan_, OSCD Community'
+status: experimental
+date: 10/05/2020
+references:
+    - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Print.yml
+    - https://twitter.com/Oddvarmoe/status/985518877076541440
+tags:
+    - attack.defense_evasion
+    - attack.t1218
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection1:
+        Image|endswith:
+            - \print.exe
+        CommandLine|contains:
+            - .exe
+    selection2:
+        CommandLine|contains:
+            - /D
+    condition: selection1 and selection2
+falsepositives:
+    - Unknown
+level: medium