Sprysocks Spooler Token Process Launch
Detects a component combining spooler token access and CreateProcessAsUser, often indicative of the Sprysocks malware. The rule specifically looks for the presence of 'spoolsv.exe' along with API calls 'OpenProcessToken', 'DuplicateTokenEx', and 'CreateProcessAsUser', which are used to elevate privileges or impersonate other users by duplicating a token from the print spooler service and then launching a new process with that token.
YARA
