Print Spooler Exploit for Privilege Escalation

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•0

Detects command-line activity associated with the Print Spooler service (`printspooler` or `spoolsv.exe`) that also contains keywords indicative of exploitation or privilege escalation (e.g., `exploit`, `privilege`, `admin`). This rule aims to identify attempts to leverage Print Spooler vulnerabilities for privilege escalation.