{"id":"dcdbc940-0bff-46b2-95f3-2d73f848e33b","title":"Suspicious Spool Service Child Process","description":"Detects suspicious print spool service (spoolsv.exe) child processes.","author":"Justin C. (@endisphotic), @dreadphones (detection), Thomas Patzke (Sigma rule)","status":"test","level":"high","date":"2021-07-11","modified":"2024-12-01","tags":["attack.execution","attack.t1203","attack.privilege-escalation","attack.t1068"],"technique_ids":["T1068","T1203"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/efa17a600b43c897b4b7463cc8541daa1987eeb4/Exploits/Print%20Spooler%20RCE/Suspicious%20Spoolsv%20Child%20Process.md"],"source_path":"rules/windows/process_creation/proc_creation_win_spoolsv_susp_child_processes.yml","source_sha256":"f805a493d83db325ad54ef895bff6e75ef9d6e4bed7c17fb7e897cb91190cd74","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_spoolsv_susp_child_processes.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Spool Service Child Process\nid: dcdbc940-0bff-46b2-95f3-2d73f848e33b\nstatus: test\ndescription: Detects suspicious print spool service (spoolsv.exe) child processes.\nreferences:\n    - https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/efa17a600b43c897b4b7463cc8541daa1987eeb4/Exploits/Print%20Spooler%20RCE/Suspicious%20Spoolsv%20Child%20Process.md\nauthor: Justin C. (@endisphotic), @dreadphones (detection), Thomas Patzke (Sigma rule)\ndate: 2021-07-11\nmodified: 2024-12-01\ntags:\n    - attack.execution\n    - attack.t1203\n    - attack.privilege-escalation\n    - attack.t1068\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    spoolsv:\n        ParentImage|endswith: '\\spoolsv.exe'\n        IntegrityLevel:\n            - 'System'\n            - 'S-1-16-16384'\n    suspicious_unrestricted:\n        Image|endswith:\n            - '\\gpupdate.exe'\n            - '\\whoami.exe'\n            - '\\nltest.exe'\n            - '\\taskkill.exe'\n            - '\\wmic.exe'\n            - '\\taskmgr.exe'\n            - '\\sc.exe'\n            - '\\findstr.exe'\n            - '\\curl.exe'\n            - '\\wget.exe'\n            - '\\certutil.exe'\n            - '\\bitsadmin.exe'\n            - '\\accesschk.exe'\n            - '\\wevtutil.exe'\n            - '\\bcdedit.exe'\n            - '\\fsutil.exe'\n            - '\\cipher.exe'\n            - '\\schtasks.exe'\n            - '\\write.exe'\n            - '\\wuauclt.exe'\n            - '\\systeminfo.exe'\n            - '\\reg.exe'\n            - '\\query.exe'\n    suspicious_net:\n        Image|endswith:\n            - '\\net.exe'\n            - '\\net1.exe'\n    suspicious_net_filter:\n        CommandLine|contains: 'start'\n    suspicious_cmd:\n        Image|endswith: '\\cmd.exe'\n    suspicious_cmd_filter:\n        CommandLine|contains:\n            - '.spl'\n            - 'route add'\n            - 'program files'\n    suspicious_netsh:\n        Image|endswith: '\\netsh.exe'\n    suspicious_netsh_filter:\n        CommandLine|contains:\n            - 'add portopening'\n            - 'rule name'\n    suspicious_powershell:\n        Image|endswith:\n            - '\\powershell.exe'\n            - '\\pwsh.exe'\n    suspicious_powershell_filter:\n        CommandLine|contains: '.spl'\n    suspicious_rundll32_img:\n        - Image|endswith: '\\rundll32.exe'\n        - OriginalFileName: 'RUNDLL32.EXE'\n    suspicious_rundll32_cli:\n        CommandLine|endswith: 'rundll32.exe'\n    condition: spoolsv and ( suspicious_unrestricted or (suspicious_net and not suspicious_net_filter) or (suspicious_cmd and not suspicious_cmd_filter) or (suspicious_netsh and not suspicious_netsh_filter) or (suspicious_powershell and not suspicious_powershell_filter) or all of suspicious_rundll32_* )\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1068","id":"T1068","name":"Exploitation for Privilege Escalation","page":"techniques/enterprise/T1068/"},{"key":"enterprise/T1203","id":"T1203","name":"Exploitation for Client Execution","page":"techniques/enterprise/T1203/"}],"data_path":"data/detection-rules/dcdbc940-0bff-46b2-95f3-2d73f848e33b.json","kind":"sigma"}