Windows Process Creation: Add-PrinterPort Commands with Executable/DLL/BAT Paths

Flags suspicious Add-PrinterPort usage referencing .exe/.dll/.bat or “Generic / Text Only” in Windows process command lines.

FreeUnreviewedSigmahighv1

windows-process-creation-add-printerport-commands-with-executable-dll-bat-paths-cc08d590

title: "Windows Process Creation: Add-PrinterPort Commands with Executable/DLL/BAT Paths"
id: 58b2d86d-6b4f-4aaa-a07c-e4e354e09d77
status: test
description: This rule flags Windows process creation events where the command line includes an Add-PrinterPort operation and also references potentially executable content via .exe, .dll, or .bat. Attackers may create printer ports to persist or execute actions through unexpected file destinations masquerading as printer-related configuration. Detection relies on process creation telemetry and command-line content inspection to identify suspicious port targets and known benign port text-only configurations.
references:
  - https://windows-internals.com/printdemon-cve-2020-1048/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Exploits/CVE-2020-1048/proc_creation_win_exploit_cve_2020_1048.yml
author: EagleEye Team, Florian Roth, Huntrule Team
date: 2020-05-13
modified: 2021-11-27
tags:
  - attack.persistence
  - attack.execution
  - attack.t1059.001
  - cve.2020-1048
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection1:
    CommandLine|contains: Add-PrinterPort -Name
  selection2:
    CommandLine|contains:
      - .exe
      - .dll
      - .bat
  selection3:
    CommandLine|contains: Generic / Text Only
  condition: (selection1 and selection2) or selection3
falsepositives:
  - New printer port install on host
level: high
license: DRL-1.1
related:
  - id: cc08d590-8b90-413a-aff6-31d1a99678d7
    type: derived

What it detects

This rule flags Windows process creation events where the command line includes an Add-PrinterPort operation and also references potentially executable content via .exe, .dll, or .bat. Attackers may create printer ports to persist or execute actions through unexpected file destinations masquerading as printer-related configuration. Detection relies on process creation telemetry and command-line content inspection to identify suspicious port targets and known benign port text-only configurations.

Known false positives

New printer port install on host

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.