Print Spooler service re-enabled via registry modification
Detects the modification of the Print Spooler (Spooler) Windows service configuration via command-line registry utilities (reg.exe or regedit.exe). This activity may indicate an attempt to restore or re-enable the Print Spooler service, which is frequently targeted for disabling as a mitigation strategy against vulnerabilities like PrintNightmare.
Sigma
