VSPMsg print processor persistence
This rule targets registry or file artifacts that install 'VSPMsg' as an x64 print processor. It specifically looks for registry modifications where the value name contains 'print processors\vspmsg' and the event subtype or actor process command line contains 'vspmsg.dll'. The XQL view retains actor and causality fields for investigation.
Cortex XDR
