Zeek DCE-RPC spoolss and IRemoteWinspool Calls Indicating Windows Print-Related Persistence

ATT&CK techniques

Persistence → Priv Esc

Recon
Resource Dev
Initial Access
Execution
Persistence
- T1547.004Winlogon Helper DLL
Priv Esc
- T1547.004Winlogon Helper DLL
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches Zeek DCE-RPC requests where specific endpoints and operations are used that align with Windows persistence techniques. Attackers can abuse these remote procedure calls to register or add print or monitor components and trigger persistence on the affected system. The detection relies on Zeek DCE-RPC telemetry that reports the RPC endpoint and operation names for remote calls.

Reporting behind it

Related detections7 linkedT1547.004 — drag to rearrange

Malicious Winlogon Shell or Userinit Persistence Modification (via registry_set)

Suspicious Command Prompt Spawned by Winlogon

Suspicious Winlogon Loading Keyboard Layout DLL kbdus1.dll

Malicious Winlogon Shell Persistence Modification (via registry_set)

Linux File Creation Indicators for TanStack Runner and Persistence Components

Windows Winlogon Notify Registry Key DLL Persistence (logon)

PowerShell ScriptBlock Winlogon Registry Modification via CurrentVersion\Winlogon

Zeek DCE-RPC spoolss and IRemoteWinspool Calls Indicating Windows Print-Related Persistence

Pivot detection · T1547.004 · 7 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

zeek-dce-rpc-indicators-of-windows-persistence-via-rpc-printer-logon-functions-53389db6

title: Zeek DCE-RPC spoolss and IRemoteWinspool Calls Indicating Windows Print-Related Persistence
id: 6fe619d6-a0a4-4b76-91da-7f2a86890669
status: test
description: This rule matches Zeek DCE-RPC requests where specific endpoints and operations are used that align with Windows persistence techniques. Attackers can abuse these remote procedure calls to register or add print or monitor components and trigger persistence on the affected system. The detection relies on Zeek DCE-RPC telemetry that reports the RPC endpoint and operation names for remote calls.
references:
  - https://github.com/mitre-attack/bzar#indicators-for-attck-persistence
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/zeek/zeek_dce_rpc_mitre_bzar_persistence.yml
author: "@neu5ron, SOC Prime, Huntrule Team"
date: 2020-03-19
modified: 2021-11-27
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547.004
logsource:
  product: zeek
  service: dce_rpc
detection:
  op1:
    endpoint: spoolss
    operation: RpcAddMonitor
  op2:
    endpoint: spoolss
    operation: RpcAddPrintProcessor
  op3:
    endpoint: IRemoteWinspool
    operation: RpcAsyncAddMonitor
  op4:
    endpoint: IRemoteWinspool
    operation: RpcAsyncAddPrintProcessor
  op5:
    endpoint: ISecLogon
    operation: SeclCreateProcessWithLogonW
  op6:
    endpoint: ISecLogon
    operation: SeclCreateProcessWithLogonExW
  condition: 1 of op*
falsepositives:
  - Windows administrator tasks or troubleshooting
  - Windows management scripts or software
level: medium
license: DRL-1.1
related:
  - id: 53389db6-ba46-48e3-a94c-e0f2cefe1583
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL