Suspicious DCERPC SMB Spoolss Named Pipe (via security)

title: Suspicious DCERPC SMB Spoolss Named Pipe (via security)
id: 9eae542f-5867-5513-8d2c-70ddea6a6933
status: stable
description: This rule detects the use of the spoolss named pipe over SMB. This can be leveraged to trigger the authentication via NTLM of any machine that has the spoolservice enabled.
references:
    - https://attack.mitre.org/techniques/T1021/002/
    - https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1
    - https://dirkjanm.io/a-different-way-of-abusing-zerologon/
    - https://twitter.com/_dirkjan/status/1309214379003588608
author: Huntrule Team
date: 2026-03-09
tags:
    - attack.lateral-movement
    - attack.t1021.002
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5145
        ShareName: '\\\\\*\\IPC$'
        RelativeTargetName: spoolss
    condition: selection
falsepositives:
    - Unknown
level: medium