Windows Print Spooler Service Suspicious DLL Load from Driver Backup Folder

SigmaHQ Detections@sigmaHQ

•updated Sep 13, 2024•0•27

Detects suspicious DLL loads by the Windows Print Spooler service from its backup driver folders. This behavior is indicative of exploitation attempts related to vulnerabilities like PrintNightmare (CVE-2021-1675, CVE-2021-34527) where an attacker can force the spooler service to load arbitrary DLLs, leading to privilege escalation or remote code execution.