Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40 detections
Filters
Last updated
All Time
Detection languages
16
14
3
2
2
Contributors
8
6
6
6
4
Categories
13
9
8
6
5
Platforms
38
1
1
Products / Services
10
9
6
3
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
2
1
IDS Classtypes
1
IDS Protocols
1
The following analytic detects modifications to the registry key `HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors`. It leverages data from the Endpoint.Registry data model, focusing on events where the registry path is modified. This activity is significant because attackers can exploit this registry key to load arbitrary .dll files, which will execute with elevated SYSTEM permissions and persist after a reboot. If confirmed malicious, this could allow attackers to maintain persistence, execute code with high privileges, and potentially compromise the entire system.
This rule detects potential persistence or privilege escalation attempts using Windows Print Monitors. It identifies two specific behaviors: the registry modification of the Print Monitors key to load a DLL from a non-standard, user-writable directory (e.g., ProgramData or Users) which is subsequently loaded by the print spooler service (spoolsv.exe), and suspicious registry activity occurring immediately prior to such modifications, specifically involving non-system accounts or vendor-specific services writing to HKLM registry paths.
This rule detects potential persistence or privilege escalation attempts using Windows Print Monitors. It identifies two specific behaviors: the registry modification of the Print Monitors key to load a DLL from a non-standard, user-writable directory (e.g., ProgramData or Users) which is subsequently loaded by the print spooler service (spoolsv.exe), and suspicious registry activity occurring immediately prior to such modifications, specifically involving non-system accounts or vendor-specific services writing to HKLM registry paths.
Detects potential PrintNightmare or Print Spooler exploitation by monitoring for the spoolsv.exe service spawning suspicious child processes (e.g., cmd, powershell, rundll32) and unauthorized files being dropped into the printer driver directory.
Detects suspicious activity related to the Print Spooler service (spoolsv.exe), specifically focusing on the spawning of known command-line interpreters (cmd.exe, powershell.exe, rundll32.exe) by spoolsv.exe, as well as the creation or modification of DLL files within the system print spool drivers directory by processes other than spoolsv.exe. This activity is often associated with privilege escalation and persistence techniques involving print spooler service abuse.
Detects PrintNightmare print spooler exploitation attempts
Detects potential PrintNightmare or Print Spooler exploitation by monitoring for the spoolsv.exe service spawning suspicious child processes (e.g., cmd, powershell, rundll32) and unauthorized files being dropped into the printer driver directory.
Detects suspicious activity related to the Print Spooler service (spoolsv.exe), specifically focusing on the spawning of known command-line interpreters (cmd.exe, powershell.exe, rundll32.exe) by spoolsv.exe, as well as the creation or modification of DLL files within the system print spool drivers directory by processes other than spoolsv.exe. This activity is often associated with privilege escalation and persistence techniques involving print spooler service abuse.
This rule detects the creation or modification of a file named 'config.dat' within the Windows print spooler's color driver directory (system32\spool\drivers\color). This activity is considered suspicious when it occurs outside of normal print workflows, as it could indicate malicious manipulation of printer configurations, potentially for persistence or privilege escalation. The rule focuses on capturing causality information to aid in investigation.
Detects registration of malicious port monitor DLLs via print spooler
This rule detects Portable Executable (PE) files that contain a cluster of API calls commonly associated with process doppelganging techniques, specifically targeting the 'spoolsv.exe' process. The presence of 'NtCreateTransaction', 'CreateFileTransacted', 'NtCreateSection', 'NtCreateProcessEx', and 'NtCreateThreadEx' in conjunction with 'spoolsv.exe' suggests an attempt to inject malicious code into a legitimate process using advanced evasion techniques.
Detects registration of malicious port monitor DLLs via print spooler
This rule detects network traffic on port 445 (SMB) where the content of the traffic contains both "Monitors" and "spoolsv" (case-insensitive). This combination of keywords suggests an attempt to register a port monitor DLL via the Print Spooler service, which is a known technique for persistence and privilege escalation.
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation.
A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.
A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.
Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification
Detects changes to the default RDP port.
Remote desktop is a common feature in operating systems. It allows a user to log into a remote system using an interactive session with a graphical user interface.
Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).
Remote desktop is a common feature in operating systems. It allows a user to log into a remote system using an interactive session with a graphical user interface.
Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).
Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup. This rule detects the modification of registry keys under 'Control\Print\Monitors\' where a DLL is specified, indicating the potential for port monitor persistence.
Detects scenarios where an attacker exploit the PrintNightmare vulnerability by abusing the Windows print spooler using the service exposed by Gentilkiwi
Detects scenarios where an attacker exploit the PrintNightmare vulnerability by abusing the Windows print spooler using the service exposed by Gentilkiwi
KQL Query from file: Threat Hunting - MDE Network Intrusion Discovery
Page 1 of 2