Windows Process Creation: Add-PrinterPort Commands with Suspicious File Paths

Flags suspicious Add-PrinterPort usage referencing .exe/.dll/.bat or “Generic / Text Only” in Windows process command lines.

FreeReviewedSigma · High · v5

Product: windows
Category: process_creation
Author: EagleEye Team, Florian Roth (SigmaHQ), DRL 1.1
Published: 2020-05-13
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1059.001PowerShell
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows command-line activity that adds printer ports via Add-PrinterPort -Name when the command line includes executable, DLL, or batch file extensions. It also matches printer port creation commands containing the string "Generic / Text Only." These behaviors can matter because attackers may abuse printer port configuration to trigger execution or persistence using crafted targets. The detection relies on process creation telemetry and string matching on the process command line.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange

Suspicious Node.js Spawning Script Interpreter for Dropped Payload

Suspicious PowerShell Remote Download and Execution via Invoke-WebRequest

Suspicious Script Host Spawning Hidden PowerShell (via process_creation)

Suspicious PowerShell Reflective Assembly Load With GZip Decompression (via process_creation)

Suspicious PowerShell Invoke-Expression with Replace Obfuscation

Suspicious PowerShell Archive Extraction to AppData Roaming

Malicious PowerShell Spawned by Masqueraded NVIDIA GeForce Experience Binary

Suspicious PowerShell Hidden Unrestricted Execution via ClickFix

Suspicious PowerShell Spawned by cscript in Script Chain

Windows Process Creation: Add-PrinterPort Commands with Suspicious File Paths

Pivot detection · T1059.001 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-add-printerport-commands-with-executable-dll-bat-paths-cc08d590

title: "Windows Process Creation: Add-PrinterPort Commands with Suspicious File Paths"
id: 58b2d86d-6b4f-4aaa-a07c-e4e354e09d77
status: test
description: This rule flags Windows command-line activity that adds printer ports via Add-PrinterPort -Name when the command line includes executable, DLL, or batch file extensions. It also matches printer port creation commands containing the string "Generic / Text Only." These behaviors can matter because attackers may abuse printer port configuration to trigger execution or persistence using crafted targets. The detection relies on process creation telemetry and string matching on the process command line.
references:
  - https://windows-internals.com/printdemon-cve-2020-1048/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Exploits/CVE-2020-1048/proc_creation_win_exploit_cve_2020_1048.yml
author: EagleEye Team, Florian Roth, Huntrule Team
date: 2020-05-13
modified: 2021-11-27
tags:
  - attack.persistence
  - attack.execution
  - attack.t1059.001
  - cve.2020-1048
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection1:
    CommandLine|contains: Add-PrinterPort -Name
  selection2:
    CommandLine|contains:
      - .exe
      - .dll
      - .bat
  selection3:
    CommandLine|contains: Generic / Text Only
  condition: (selection1 and selection2) or selection3
falsepositives:
  - New printer port install on host
level: high
license: DRL-1.1
related:
  - id: cc08d590-8b90-413a-aff6-31d1a99678d7
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL