Query: detect Detects suspicious print spool service (spoolsv.exe) child processes. in logs
Matching passage: Sigma rule: Detects suspicious print spool service (spoolsv.exe) child processes.. Logsource: windows / process_creation. Rule: title: Suspicious Spool Service Child Process id: dcdbc940-0bff-46b2-95f3-2d73f848e33b status: test description: Detects suspicious print spool service (spoolsv.exe) child processes. references: - https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/efa17a600b43c897b4b7463cc8541daa1987eeb4/Exploits/Print%20Spooler%20RCE/Suspicious%20Spoolsv%20Child%20Process.md author: Justin C. (@endisphotic), @dreadphones (detection), Thomas Patzke (Sigma rule) date: 2021-07-11 modified: 2024-12-01 tags: - attack.execution - attack.t1203 - attack.privilege-escalation - attack.t1068 logsource: category: process_creation product: windows detection: spoolsv: ParentImage|endswith: \spoolsv.exe IntegrityLevel: - System - S-1-16-16384 suspicious_unrestricted: Image|endswith: - \gpupdate.exe - \whoami.exe - \nltest.exe - \taskkill.exe - \wmic.exe - \taskmgr.exe - \sc.exe - \findstr.exe - \curl.exe - \wget.exe - \certutil.exe - \bitsadmin.exe - \accesschk.exe - \wevtutil.exe - \bcdedit.exe - \fsutil.exe - \cipher.exe - \schtasks.exe - \write.exe - \wuauclt.exe - \systeminfo.exe - \reg.exe - \query.exe suspicious_net: Image|endswith: - \net.exe - \net1.exe suspicious_net_filter: CommandLine|contains: start suspicious_cmd: Image|endswith: \cmd.exe suspicious_cmd_filter: CommandLine|contains: - .spl - route add - program files suspicious_netsh: Image|endswith: \netsh.exe suspicious_netsh_filter: CommandLine|contains: - add portopening - rule name suspicious_powershell: Image|endswith: - \powershell.exe - \pwsh.exe suspicious_powershell_filter: CommandLine|contains: .spl suspicious_rundll32_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE suspicious_rundll32_cli: CommandLine|endswith: rundll32.exe condition: spoolsv and ( suspicious_unrestricted or (suspicious_net and not suspicious_net_filter) or (suspicious_cmd and not suspicious_cmd_filter) or (suspicious_netsh and not suspicious_netsh_filter) or (suspicious_powershell and not suspicious_powershell_filter) or all of suspicious_rundll32_* ) falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.).. Logsource: windows / image_load. Rule: title: Potential System DLL Sideloading From Non System Locations id: 4fc0deee-0057-4998-ab31-d24e46e0aba4 status: test description: Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.). references: - https://hijacklibs.net/ - https://blog.cyble.com/2022/07/21/qakbot-resurfaces-with-new-playbook/ - https://blog.cyble.com/2022/07/27/targeted-attacks-being-carried-out-via-dll-sideloading/ - https://github.com/XForceIR/SideLoadHunter/blob/cc7ef2e5d8908279b0c4cee4e8b6f85f7b8eed52/SideLoads/README.md - https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/ - https://www.sophos.com/en-us/blog/finding-minhook-in-a-sideloading-attack-and-sweden-too author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-14 modified: 2026-07-10 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: - \aclui.dll - \activeds.dll - \adsldpc.dll - \aepic.dll - \apphelp.dll - \applicationframe.dll - \appvpolicy.dll - \appxalluserstore.dll - \appxdeploymentclient.dll - \archiveint.dll - \atl.dll - \audioses.dll - \auditpolcore.dll - \authfwcfg.dll - \authz.dll - \avrt.dll - \batmeter.dll - \bcd.dll - \bcp47langs.dll - \bcp47mrm.dll - \bcrypt.dll - \bderepair.dll - \bootmenuux.dll - \bootux.dll - \cabinet.dll - \cabview.dll - \certcli.dll - \certenroll.dll - \cfgmgr32.dll - \cldapi.dll - \clipc.dll - \clusapi.dll - \cmpbk32.dll - \cmutil.dll - \coloradapterclient.dll - \colorui.dll - \comdlg32.dll - \configmanager2.dll - \connect.dll - \coredplus.dll - \coremessaging.dll - \coreuicomponents.dll - \credui.dll - \cryptbase.dll - \cryptdll.dll - \cryptsp.dll - \cryptui.dll - \cryptxml.dll - \cscapi.dll - \cscobj.dll - \cscui.dll - \d2d1.dll - \d3d10_1.dll - \d3d10_1core.dll - \d3d10.dll - \d3d10core.dll - \d3d10warp.dll - \d3d11.dll - \d3d12.dll - \d3d9.dll - \d3dx9_43.dll - \dataexchange.dll - \davclnt.dll - \dcntel.dll - \dcomp.dll - \defragproxy.dll - \desktopshellext.dll - \deviceassociation.dll - \devicecredential.dll - \devicepairing.dll - \devobj.dll - \devrtl.dll - \dhcpcmonitor.dll - \dhcpcsvc.dll - \dhcpcsvc6.dll - \directmanipulation.dll - \dismapi.dll - \dismcore.dll - \dmcfgutils.dll - \dmcmnutils.dll - \dmcommandlineutils.dll - \dmenrollengine.dll - \dmenterprisediagnostics.dll - \dmiso8601utils.dll - \dmoleaututils.dll - \dmprocessxmlfiltered.dll - \