CVE-2020-1048 Exploitation Attempt - Suspicious New Printer Ports via Registry

SigmaHQ Detections@sigmaHQ

•updated Jun 12, 2025•0•20

Detects changes to the "Ports" registry key with data that includes a Windows path or a file with a suspicious extension. This could indicate an attempt to exploit CVE-2020-1048, a Windows Print Spooler elevation of privilege vulnerability, by registering a malicious printer port.