1200kmSECURITY RESEARCH

1200KM / sigma-rule

DCERPC SMB Spoolss Named Pipe — Sigma Rule

Sigma rule 214e8f95-100a-4e04-bb31-ef6cba8ce07e. DCERPC SMB Spoolss Named Pipe — Sigma Rule. Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.

Rule metadata and linked tags

testmediumwindowssecurityattack.lateral-movementattack.t1021.002

Author: OTR (Open Threat Research). Source status: test; severity: medium. Source dates: 2018-11-28 / 2022-08-11.

Original logsource
{
  "product": "windows",
  "service": "security"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 03b86f4282d6432a63de5ab772a8bb37547c964a1b1cfe67d5b5af046d08dd40

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

Original Sigma rule YAML, scroll horizontally if needed
title: DCERPC SMB Spoolss Named Pipe
id: 214e8f95-100a-4e04-bb31-ef6cba8ce07e
status: test
description: Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.
references:
    - https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1
    - https://dirkjanm.io/a-different-way-of-abusing-zerologon/
    - https://twitter.com/_dirkjan/status/1309214379003588608
author: OTR (Open Threat Research)
date: 2018-11-28
modified: 2022-08-11
tags:
    - attack.lateral-movement
    - attack.t1021.002
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5145
        ShareName: '\\\\\*\\IPC$' # looking for the string \\*\IPC$
        RelativeTargetName: spoolss
    condition: selection
falsepositives:
    - 'Domain Controllers acting as printer servers too? :)'
level: medium

Original YAML and metadata in JSON

False positives

  • Domain Controllers acting as printer servers too? :)

Source references

Connected ecosystem references

Exact source-tagged techniques

Telemetry review

Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.

Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.