Suspicious Print Spooler Service Child Process
This rule detects suspicious child processes spawned by the Windows Print Spooler service (spoolsv.exe) running with System integrity. The detection logic specifically looks for the execution of various Windows utilities and command-line interpreters (like cmd.exe, powershell.exe, net.exe, wmic.exe, certutil.exe, bitsadmin.exe, rundll32.exe, etc.) that are commonly abused by attackers for execution, privilege escalation, or reconnaissance after exploiting vulnerabilities in the Print Spooler service (e.g., PrintNightmare). The rule includes filters to reduce false positives for some commands.
Sigma
