
title: Suspicious Spool Service Child Process
author: Justin C. (@endisphotic), @dreadphones (detection), Thomas Patzke (Sigma rule)
date: 2021/07/11
description: Detects suspicious print spool service (spoolsv.exe) child processes.
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_10:
    CommandLine:
    - '*.spl*'
    - '*route add*'
    - '*program files*'
  SELECTION_11:
    EventID: 1
  SELECTION_12:
    Image: '*\netsh.exe'
  SELECTION_13:
    CommandLine:
    - '*add portopening*'
    - '*rule name*'
  SELECTION_14:
    EventID: 1
  SELECTION_15:
    Image: '*\powershell.exe'
  SELECTION_16:
    CommandLine: '*.spl*'
  SELECTION_17:
    Image: '*\rundll32.exe'
  SELECTION_18:
    CommandLine: '*rundll32.exe'
  SELECTION_2:
    ParentImage: '*\\spoolsv.exe'
  SELECTION_3:
    IntegrityLevel: System
  SELECTION_4:
    Image:
    - '*\gpupdate.exe'
    - '*\whoami.exe'
    - '*\nltest.exe'
    - '*\taskkill.exe'
    - '*\wmic.exe'
    - '*\taskmgr.exe'
    - '*\sc.exe'
    - '*\findstr.exe'
    - '*\curl.exe'
    - '*\wget.exe'
    - '*\certutil.exe'
    - '*\bitsadmin.exe'
    - '*\accesschk.exe'
    - '*\wevtutil.exe'
    - '*\bcdedit.exe'
    - '*\fsutil.exe'
    - '*\cipher.exe'
    - '*\schtasks.exe'
    - '*\write.exe'
    - '*\wuauclt.exe'
  SELECTION_5:
    EventID: 1
  SELECTION_6:
    Image: '*\net.exe'
  SELECTION_7:
    CommandLine: '*start*'
  SELECTION_8:
    EventID: 1
  SELECTION_9:
    Image: '*\cmd.exe'
  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3 and (((((SELECTION_4 or
    (SELECTION_5 and SELECTION_6 and  not (SELECTION_7))) or (SELECTION_8 and SELECTION_9
    and  not (SELECTION_10))) or (SELECTION_11 and SELECTION_12 and  not (SELECTION_13)))
    or (SELECTION_14 and SELECTION_15 and  not (SELECTION_16))) or (SELECTION_17 and
    SELECTION_18)))
falsepositives:
- None known
fields:
- Image
- CommandLine
id: dcdbc940-0bff-46b2-95f3-2d73f848e33b
level: high
logsource:
  category: process_creation
  product: windows
references:
- https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/master/Exploits/Print%20Spooler%20RCE/Suspicious%20Spoolsv%20Child%20Process.md
status: stable
tags:
- attack.execution
- attack.t1203
- attack.privilege_escalation
- attack.t1068
ruletype: SIGMA
