Add Port Monitor Persistence in Registry

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•21

Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup. This rule detects the modification of registry keys under 'Control\Print\Monitors\' where a DLL is specified, indicating the potential for port monitor persistence.