Windows Registry: Add Print Port Monitor DLL Persistence
Flags registry updates to Print Port Monitors that reference .dll components for potential startup persistence on Windows.
- Product
- windows
- Category
- registry_set
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2021-12-30
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies registry set activity that writes a port monitor entry under the Print Monitors control path where the Details value ends in .dll, indicating a DLL-backed startup component. This matters because loading an attacker-supplied DLL via port monitor startup can support persistence and potential privilege escalation. It relies on Windows registry set telemetry capturing TargetObject and Details values for the affected port monitor path, with optional exclusions to reduce known benign monitor entries.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry: Add Print Port Monitor DLL Persistence"
id: 4befdea0-3423-49c3-ab11-282f00621f5e
status: test
description: This rule identifies registry set activity that writes a port monitor entry under the Print Monitors control path where the Details value ends in .dll, indicating a DLL-backed startup component. This matters because loading an attacker-supplied DLL via port monitor startup can support persistence and potential privilege escalation. It relies on Windows registry set telemetry capturing TargetObject and Details values for the affected port monitor path, with optional exclusions to reduce known benign monitor entries.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.010/T1547.010.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_add_port_monitor.yml
author: frack113, Huntrule Team
date: 2021-12-30
modified: 2024-03-25
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1547.010
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: \Control\Print\Monitors\
Details|endswith: .dll
filter_optional_cutepdf:
Image: C:\Windows\System32\spoolsv.exe
TargetObject|contains: \Control\Print\Monitors\CutePDF Writer Monitor v4.0\Driver
Details: cpwmon64_v40.dll
User|contains:
- AUTHORI
- AUTORI
filter_optional_monvnc:
TargetObject|contains: \Control\Print\Monitors\MONVNC\Driver
filter_optional_vnc:
TargetObject|contains|all:
- Control\Print\Environments\
- \Drivers\
- \VNC Printer
condition: selection and not 1 of filter_optional_*
falsepositives:
- Unknown
level: medium
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_add_port_monitor/info.yml
simulation:
- type: atomic-red-team
name: Add Port Monitor persistence in Registry
technique: T1547.010
atomic_guid: d34ef297-f178-4462-871e-9ce618d44e50
license: DRL-1.1
related:
- id: 944e8941-f6f6-4ee8-ac05-1c224e923c0e
type: derived