Windows Spooler spoolsv.exe Loads DLL from Spool Drivers Subdirectories

Flags spoolsv.exe DLL loads originating from Print Spooler x64\3/x64\4 driver folders on Windows.

FreeUnreviewedSigmainformationalv1

windows-spooler-spoolsv-exe-loads-dll-from-spool-drivers-subdirectories-02fb90de

title: Windows Spooler spoolsv.exe Loads DLL from Spool Drivers Subdirectories
id: fc01012f-a4a4-4e18-a25e-8b30ee9320c3
status: test
description: This rule identifies cases where spoolsv.exe loads a DLL whose path is located under the Windows Print Spooler driver subdirectories (specifically the x64\3 and x64\4 driver folders) and ends with .dll. Such DLL loads can indicate unauthorized or suspicious module injection into the Print Spooler service, which is a high-value target for attackers seeking persistence or privilege impact. The detection relies on image load telemetry that includes the loaded module path and the loading process image name.
references:
  - https://web.archive.org/web/20210629055600/https://github.com/hhlxf/PrintNightmare/
  - https://github.com/ly4k/SpoolFool
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2021/Exploits/CVE-2021-1675/image_load_exploit_cve_2021_1675_spoolsv_dll_load.yml
author: FPT.EagleEye, Thomas Patzke (improvements), Huntrule Team
date: 2021-06-29
modified: 2022-06-02
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574
  - cve.2021-1675
  - cve.2021-34527
  - detection.emerging-threats
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith: \spoolsv.exe
    ImageLoaded|contains:
      - \Windows\System32\spool\drivers\x64\3\
      - \Windows\System32\spool\drivers\x64\4\
    ImageLoaded|endswith: .dll
  condition: selection
falsepositives:
  - Loading of legitimate driver
level: informational
license: DRL-1.1
related:
  - id: 02fb90de-c321-4e63-a6b9-25f4b03dfd14
    type: derived

What it detects

This rule identifies cases where spoolsv.exe loads a DLL whose path is located under the Windows Print Spooler driver subdirectories (specifically the x64\3 and x64\4 driver folders) and ends with .dll. Such DLL loads can indicate unauthorized or suspicious module injection into the Print Spooler service, which is a high-value target for attackers seeking persistence or privilege impact. The detection relies on image load telemetry that includes the loaded module path and the loading process image name.

Known false positives

Loading of legitimate driver

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.