Windows spoolsv.exe Child Process Execution Indicators

Flags suspicious process executions where spoolsv.exe (print spooler) spawns utility, scripting, or rundll32 children with high integrity.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: Justin C. (@endisphotic), @dreadphones (detection), Thomas Patzke (Sigma rule) (SigmaHQ), DRL 1.1
Published: 2021-07-11
Updated: 2026-07-30

Analysis Detection

ATT&CK techniques

Execution → Priv Esc

Recon
Resource Dev
Initial Access
Execution
- T1203Exploitation for Client Execution
Persistence
Priv Esc
- T1068Exploitation for Privilege Escalation
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies suspicious child processes spawned by the Windows Print Spooler service executable (spoolsv.exe) running with high integrity (System or S-1-16-16384). Attackers may abuse the spooler to launch diagnostic, networking, command, scripting, download, or system configuration utilities, which can support privilege escalation and follow-on actions. It relies on Windows process creation telemetry, including parent image, child process image, integrity level, and—where specified—command-line content filters to reduce expected benign patterns.

Reporting behind it

Related detections9 linkedT1068 — drag to rearrange

Zeek HTTP POST to /wsman without Authorization — Possible OMIGOD unauthenticated RCE (CVE-2021-38647)

Windows Audit-CVE: User Applications Writing CveEventWrite Events (Event ID 1)

Suspicious Modification of Privileged Authentication Binaries via Kernel LPE

Malicious EDR Evasion Driver Load from AnyDesk Directory via k.sys (via image_load)

Malicious Zemana Vulnerable Driver Load for EDR Termination (via image_load)

Suspicious EDRKillShifter Vulnerable Driver Load from User Temp Directory (via image_load)

Suspicious Process Explorer Kernel Driver Dropped as PED.sys via File Creation (via file_event)

Malicious Payload Download From copy.fail Exploit Host on Linux (via process_creation)

Suspicious su Execution From Uncommon Parent Process on Linux (via process_creation)

Windows spoolsv.exe Child Process Execution Indicators

Pivot detection · T1068 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-spoolsv-exe-child-process-execution-indicators-dcdbc940

title: Windows spoolsv.exe Child Process Execution Indicators
id: f322cdd1-a943-40d8-a051-4209f0b81b2f
status: test
description: This rule identifies suspicious child processes spawned by the Windows Print Spooler service executable (spoolsv.exe) running with high integrity (System or S-1-16-16384). Attackers may abuse the spooler to launch diagnostic, networking, command, scripting, download, or system configuration utilities, which can support privilege escalation and follow-on actions. It relies on Windows process creation telemetry, including parent image, child process image, integrity level, and—where specified—command-line content filters to reduce expected benign patterns.
references:
  - https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/efa17a600b43c897b4b7463cc8541daa1987eeb4/Exploits/Print%20Spooler%20RCE/Suspicious%20Spoolsv%20Child%20Process.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_spoolsv_susp_child_processes.yml
author: Justin C. (@endisphotic), @dreadphones (detection), Thomas Patzke (Sigma rule), Huntrule Team
date: 2021-07-11
modified: 2024-12-01
tags:
  - attack.execution
  - attack.t1203
  - attack.privilege-escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  spoolsv:
    ParentImage|endswith: \spoolsv.exe
    IntegrityLevel:
      - System
      - S-1-16-16384
  suspicious_unrestricted:
    Image|endswith:
      - \gpupdate.exe
      - \whoami.exe
      - \nltest.exe
      - \taskkill.exe
      - \wmic.exe
      - \taskmgr.exe
      - \sc.exe
      - \findstr.exe
      - \curl.exe
      - \wget.exe
      - \certutil.exe
      - \bitsadmin.exe
      - \accesschk.exe
      - \wevtutil.exe
      - \bcdedit.exe
      - \fsutil.exe
      - \cipher.exe
      - \schtasks.exe
      - \write.exe
      - \wuauclt.exe
      - \systeminfo.exe
      - \reg.exe
      - \query.exe
  suspicious_net:
    Image|endswith:
      - \net.exe
      - \net1.exe
  suspicious_net_filter:
    CommandLine|contains: start
  suspicious_cmd:
    Image|endswith: \cmd.exe
  suspicious_cmd_filter:
    CommandLine|contains:
      - .spl
      - route add
      - program files
  suspicious_netsh:
    Image|endswith: \netsh.exe
  suspicious_netsh_filter:
    CommandLine|contains:
      - add portopening
      - rule name
  suspicious_powershell:
    Image|endswith:
      - \powershell.exe
      - \pwsh.exe
  suspicious_powershell_filter:
    CommandLine|contains: .spl
  suspicious_rundll32_img:
    - Image|endswith: \rundll32.exe
    - OriginalFileName: RUNDLL32.EXE
  suspicious_rundll32_cli:
    CommandLine|endswith: rundll32.exe
  condition: spoolsv and ( suspicious_unrestricted or (suspicious_net and not suspicious_net_filter) or (suspicious_cmd and not suspicious_cmd_filter) or (suspicious_netsh and not suspicious_netsh_filter) or (suspicious_powershell and not suspicious_powershell_filter) or all of suspicious_rundll32_* )
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: dcdbc940-0bff-46b2-95f3-2d73f848e33b
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL