Suspicious Printer Port Creation (CVE-2020-1048)

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•26

Detects the creation of suspicious printer ports that point to executable files or use the 'Generic / Text Only' driver, which can be abused for persistence or execution, often associated with CVE-2020-1048 (PrintDemon).