Suspicious NTLM Authentication Coercion on Printer Spooler Service

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•2•0•16

This rule detects attempts to coerce NTLM authentication on the Printer Spooler service, which can be used for privilege escalation. Specifically, it looks for `rundll32.exe` executing with command-line arguments related to `davclnt.dll,DavSetCookie` and keywords like `spoolss`, `srvsvc`, or `/print/pipe/`, indicating an NTLM relay attack against the print spooler service.