Spooler Process Injection Activity Followed by svchost Execution

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•0•0•2

Detects process injection telemetry targeting spoolsv.exe followed by an unusual svchost child or related launch from the same initiating process. The condition requires the reported SprySOCKS component, path, or execution relationship rather than a common Windows artefact alone.