DCERPC SMB Spoolss Named Pipe Abuse

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•37

Detects the use of the 'spoolss' named pipe over SMB, which can be leveraged to trigger NTLM authentication from a target machine with the print spooler service enabled. This technique is often used in NTLM relay attacks or other forms of printer spooler abuse to gain unauthorized access or escalate privileges.