Windows spoolsv.exe Child Process Execution Indicators

title: Windows spoolsv.exe Child Process Execution Indicators
id: f322cdd1-a943-40d8-a051-4209f0b81b2f
status: test
description: This rule identifies suspicious child processes spawned by the Windows Print Spooler service executable (spoolsv.exe) running with high integrity (System or S-1-16-16384). Attackers may abuse the spooler to launch diagnostic, networking, command, scripting, download, or system configuration utilities, which can support privilege escalation and follow-on actions. It relies on Windows process creation telemetry, including parent image, child process image, integrity level, and—where specified—command-line content filters to reduce expected benign patterns.
references:
  - https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/efa17a600b43c897b4b7463cc8541daa1987eeb4/Exploits/Print%20Spooler%20RCE/Suspicious%20Spoolsv%20Child%20Process.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_spoolsv_susp_child_processes.yml
author: Justin C. (@endisphotic), @dreadphones (detection), Thomas Patzke (Sigma rule), Huntrule Team
date: 2021-07-11
modified: 2024-12-01
tags:
  - attack.execution
  - attack.t1203
  - attack.privilege-escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  spoolsv:
    ParentImage|endswith: \spoolsv.exe
    IntegrityLevel:
      - System
      - S-1-16-16384
  suspicious_unrestricted:
    Image|endswith:
      - \gpupdate.exe
      - \whoami.exe
      - \nltest.exe
      - \taskkill.exe
      - \wmic.exe
      - \taskmgr.exe
      - \sc.exe
      - \findstr.exe
      - \curl.exe
      - \wget.exe
      - \certutil.exe
      - \bitsadmin.exe
      - \accesschk.exe
      - \wevtutil.exe
      - \bcdedit.exe
      - \fsutil.exe
      - \cipher.exe
      - \schtasks.exe
      - \write.exe
      - \wuauclt.exe
      - \systeminfo.exe
      - \reg.exe
      - \query.exe
  suspicious_net:
    Image|endswith:
      - \net.exe
      - \net1.exe
  suspicious_net_filter:
    CommandLine|contains: start
  suspicious_cmd:
    Image|endswith: \cmd.exe
  suspicious_cmd_filter:
    CommandLine|contains:
      - .spl
      - route add
      - program files
  suspicious_netsh:
    Image|endswith: \netsh.exe
  suspicious_netsh_filter:
    CommandLine|contains:
      - add portopening
      - rule name
  suspicious_powershell:
    Image|endswith:
      - \powershell.exe
      - \pwsh.exe
  suspicious_powershell_filter:
    CommandLine|contains: .spl
  suspicious_rundll32_img:
    - Image|endswith: \rundll32.exe
    - OriginalFileName: RUNDLL32.EXE
  suspicious_rundll32_cli:
    CommandLine|endswith: rundll32.exe
  condition: spoolsv and ( suspicious_unrestricted or (suspicious_net and not suspicious_net_filter) or (suspicious_cmd and not suspicious_cmd_filter) or (suspicious_netsh and not suspicious_netsh_filter) or (suspicious_powershell and not suspicious_powershell_filter) or all of suspicious_rundll32_* )
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: dcdbc940-0bff-46b2-95f3-2d73f848e33b
    type: derived