Zeek SMB Files: spoolss Named Pipe Access via IPC$

Flags Zeek SMB events accessing the spoolss named pipe via IPC$.

FreeUnreviewedSigmamediumv1

zeek-smb-files-spoolss-named-pipe-access-via-ipc-bae2865c

title: "Zeek SMB Files: spoolss Named Pipe Access via IPC$"
id: 7e9689f4-e12a-4065-8f3b-8259145e1e0c
status: test
description: This rule matches Zeek SMB file activity where the accessed path ends with IPC$ and the named pipe/session target is spoolss. Attackers can use spoolss over SMB to interact with the Windows print spooler interface, which may involve coercing or triggering authentication to facilitate lateral movement. The detection relies on Zeek SMB file telemetry capturing the IPC$ endpoint and the pipe name.
references:
  - https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1
  - https://dirkjanm.io/a-different-way-of-abusing-zerologon/
  - https://twitter.com/_dirkjan/status/1309214379003588608
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/zeek/zeek_dce_rpc_smb_spoolss_named_pipe.yml
author: OTR (Open Threat Research), @neu5ron, Huntrule Team
date: 2018-11-28
modified: 2022-10-09
tags:
  - attack.lateral-movement
  - attack.t1021.002
logsource:
  product: zeek
  service: smb_files
detection:
  selection:
    path|endswith: IPC$
    name: spoolss
  condition: selection
falsepositives:
  - Domain Controllers that are sometimes, commonly although should not be, acting as printer servers too
level: medium
license: DRL-1.1
related:
  - id: bae2865c-5565-470d-b505-9496c87d0c30
    type: derived

What it detects

This rule matches Zeek SMB file activity where the accessed path ends with IPC$ and the named pipe/session target is spoolss. Attackers can use spoolss over SMB to interact with the Windows print spooler interface, which may involve coercing or triggering authentication to facilitate lateral movement. The detection relies on Zeek SMB file telemetry capturing the IPC$ endpoint and the pipe name.

Known false positives

Domain Controllers that are sometimes, commonly although should not be, acting as printer servers too

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.