Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
38 detections
Filters
Last updated
All Time
Detection languages
19
8
4
2
2
Contributors
8
8
8
7
5
Categories
14
9
9
7
5
Platforms
38
Products / Services
14
9
8
6
4
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
10
8
IDS Classtypes
1
IDS Protocols
1
This rule detects when critical Windows services or processes associated with Active Directory (NTDS, Netlogon, LSASS, LDAP) or the Print Spooler (Spooler, spoolsv.exe) crash multiple times (3 or more) on a machine within a 7-day period. This could indicate instability, a denial-of-service attempt, or a system compromise affecting core services.
Detects potential PrintNightmare or Print Spooler exploitation by monitoring for the spoolsv.exe service spawning suspicious child processes (e.g., cmd, powershell, rundll32) and unauthorized files being dropped into the printer driver directory.
This rule detects when critical Windows services or processes associated with Active Directory (NTDS, Netlogon, LSASS, LDAP) or the Print Spooler (Spooler, spoolsv.exe) crash multiple times (3 or more) on a machine within a 7-day period. This could indicate instability, a denial-of-service attempt, or a system compromise affecting core services.
Detects suspicious activity related to the Print Spooler service (spoolsv.exe), specifically focusing on the spawning of known command-line interpreters (cmd.exe, powershell.exe, rundll32.exe) by spoolsv.exe, as well as the creation or modification of DLL files within the system print spool drivers directory by processes other than spoolsv.exe. This activity is often associated with privilege escalation and persistence techniques involving print spooler service abuse.
Detects PrintNightmare print spooler exploitation attempts
Detects potential PrintNightmare or Print Spooler exploitation by monitoring for the spoolsv.exe service spawning suspicious child processes (e.g., cmd, powershell, rundll32) and unauthorized files being dropped into the printer driver directory.
Detects suspicious activity related to the Print Spooler service (spoolsv.exe), specifically focusing on the spawning of known command-line interpreters (cmd.exe, powershell.exe, rundll32.exe) by spoolsv.exe, as well as the creation or modification of DLL files within the system print spool drivers directory by processes other than spoolsv.exe. This activity is often associated with privilege escalation and persistence techniques involving print spooler service abuse.
This rule detects the creation of a file named 'config.dat' within the Windows printer color profile directory (typically 'C:\Windows\System32\spool\drivers\color'). This activity is suspicious because 'config.dat' in this specific location is often targeted by malware, such as the SprySocks backdoor, to maintain persistence or store malicious configurations. Legitimate modifications to this file are rare and usually associated with printer driver installations or manual color profile adjustments, which should be investigated as potential false positives.
This rule detects the creation or modification of a file named 'config.dat' within the Windows print spooler's color driver directory (system32\spool\drivers\color). This activity is considered suspicious when it occurs outside of normal print workflows, as it could indicate malicious manipulation of printer configurations, potentially for persistence or privilege escalation. The rule focuses on capturing causality information to aid in investigation.
Detects the VSPMsg print processor path and DLL name, which is associated with the SprySocks malware for persistence on Windows systems. The rule looks for specific strings related to the DLL name, print processor path, and common installation directories used by this malware.
This rule detects the creation of a file named 'config.dat' within the Windows printer color profile directory (typically 'C:\Windows\System32\spool\drivers\color'). This activity is suspicious because 'config.dat' in this specific location is often targeted by malware, such as the SprySocks backdoor, to maintain persistence or store malicious configurations. Legitimate modifications to this file are rare and usually associated with printer driver installations or manual color profile adjustments, which should be investigated as potential false positives.
VSPMsg print processor persistence
Cortex XDR
This rule targets registry or file artifacts that install 'VSPMsg' as an x64 print processor. It specifically looks for registry modifications where the value name contains 'print processors\vspmsg' and the event subtype or actor process command line contains 'vspmsg.dll'. The XQL view retains actor and causality fields for investigation.
Detects the Print Spooler service (spoolsv.exe) spawning svchost.exe. This behavior is leveraged by the WIN_PLUS variant of SprySOCKS to execute a first-stage print processor loader, which then injects the backdoor into a newly created svchost.exe process.
Detects registration of malicious port monitor DLLs via print spooler
This rule detects Portable Executable (PE) files that contain a cluster of API calls commonly associated with process doppelganging techniques, specifically targeting the 'spoolsv.exe' process. The presence of 'NtCreateTransaction', 'CreateFileTransacted', 'NtCreateSection', 'NtCreateProcessEx', and 'NtCreateThreadEx' in conjunction with 'spoolsv.exe' suggests an attempt to inject malicious code into a legitimate process using advanced evasion techniques.
Targets registry or file artefacts that install VSPMsg as an x64 print processor. The UDM rule retains principal and target context for correlation.
Targets registry or file artefacts that install VSPMsg as an x64 print processor. The UDM rule retains principal and target context for correlation.
Detects registration of malicious port monitor DLLs via print spooler
This rule detects network traffic on TCP port 445 (SMB) containing the case-insensitive string "Print Processors". This pattern is indicative of an attempt to register a malicious Print Processor DLL for persistence, a technique used by adversaries to maintain access to a system. The rule specifically looks for traffic flowing to the home network, suggesting an inbound attempt to establish persistence.
Detects registration of print processor DLLs for SYSTEM-level persistent code execution
Detects potential exploitation of CVE-2021-1675 / CVE-2021-34527 (PrintNightmare) via anomalous SMB access to the IPC$ share targeting the "spoolss" named pipe (AccessMask: 0x3).
This pattern is associated with RPC-based abuse of the Windows Print Spooler service, which may allow remote code execution or privilege escalation with SYSTEM privileges.
This pattern is associated with RPC-based abuse of the Windows Print Spooler service, which may allow remote code execution or privilege escalation with SYSTEM privileges.
Page 1 of 2