Sigma rule: Suspicious Spool Service Child Process

Rule

Title

Suspicious Spool Service Child Process

Status

test

Level

high

Author

Justin C. (@endisphotic), @dreadphones (detection), Thomas Patzke (Sigma rule)

Date

2021-07-11

Modified

2024-12-01

File

rules/windows/process_creation/proc_creation_win_spoolsv_susp_child_processes.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious print spool service (spoolsv.exe) child processes.

Log source

product

windows

category

process_creation

Detection

spoolsv:
    ParentImage|endswith: '\spoolsv.exe'
    IntegrityLevel:
        - 'System'
        - 'S-1-16-16384'
suspicious_unrestricted:
    Image|endswith:
        - '\gpupdate.exe'
        - '\whoami.exe'
        - '\nltest.exe'
        - '\taskkill.exe'
        - '\wmic.exe'
        - '\taskmgr.exe'
        - '\sc.exe'
        - '\findstr.exe'
        - '\curl.exe'
        - '\wget.exe'
        - '\certutil.exe'
        - '\bitsadmin.exe'
        - '\accesschk.exe'
        - '\wevtutil.exe'
        - '\bcdedit.exe'
        - '\fsutil.exe'
        - '\cipher.exe'
        - '\schtasks.exe'
        - '\write.exe'
        - '\wuauclt.exe'
        - '\systeminfo.exe'
        - '\reg.exe'
        - '\query.exe'
suspicious_net:
    Image|endswith:
        - '\net.exe'
        - '\net1.exe'
suspicious_net_filter:
    CommandLine|contains: 'start'
suspicious_cmd:
    Image|endswith: '\cmd.exe'
suspicious_cmd_filter:
    CommandLine|contains:
        - '.spl'
        - 'route add'
        - 'program files'
suspicious_netsh:
    Image|endswith: '\netsh.exe'
suspicious_netsh_filter:
    CommandLine|contains:
        - 'add portopening'
        - 'rule name'
suspicious_powershell:
    Image|endswith:
        - '\powershell.exe'
        - '\pwsh.exe'
suspicious_powershell_filter:
    CommandLine|contains: '.spl'
suspicious_rundll32_img:
    - Image|endswith: '\rundll32.exe'
    - OriginalFileName: 'RUNDLL32.EXE'
suspicious_rundll32_cli:
    CommandLine|endswith: 'rundll32.exe'
condition: spoolsv and ( suspicious_unrestricted or (suspicious_net and not suspicious_net_filter) or (suspicious_cmd and not suspicious_cmd_filter) or (suspicious_netsh and not suspicious_netsh_filter) or (suspicious_powershell and not suspicious_powershell_filter) or all of suspicious_rundll32_* )

False positives (as the rule lists them)

• Unknown

Tags

• attack.execution
• attack.t1203
• attack.privilege-escalation
• attack.t1068

MITRE ATT&CK ids this rule names

• T1068
• T1203

References

• https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/efa17a600b43c897b4b7463cc8541daa1987eeb4/Exploits/Print%20Spooler%20RCE/Suspicious%20Spoolsv%20Child%20Process.md

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_spoolsv_susp_child_processes.yml