Windows Print Spooler Forced Authentication (PrinterBug)

Lacey Cochrane@NullVectorX

•updated Sep 20, 2026•2•0•30

Detects the use of the RpcRemoteFindFirstPrinterChangeNotificationEx function (opnum 58) on the Spoolss RPC interface. This function can be abused by attackers to coerce the Print Spooler service into authenticating against an attacker-controlled host via SMB, a technique commonly referred to as 'PrinterBug' or 'SpoolSample'. This authentication can subsequently be relayed to other services (such as AD CS or LDAP) to achieve privilege escalation.