Suspicious SMB Spoolss Name Piped Use (via smb_files)

title: Suspicious SMB Spoolss Name Piped Use (via smb_files)
id: ea27bdd2-3c0a-522b-b6e1-8dfdcddbc2e7
status: stable
description: This rule detects the use of the spoolss named pipe over SMB. This can be leveraged to trigger the authentication via NTLM of any machine that has the spoolservice enabled.
references:
    - https://attack.mitre.org/techniques/T1021/002/
    - https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1
    - https://dirkjanm.io/a-different-way-of-abusing-zerologon/
    - https://twitter.com/_dirkjan/status/1309214379003588608
author: Huntrule Team
date: 2026-02-11
tags:
    - attack.lateral-movement
    - attack.t1021.002
logsource:
    product: zeek
    service: smb_files
detection:
    selection:
        path|endswith: 'IPC$'
        name: spoolss
    condition: selection
falsepositives:
    - Unknown
level: medium