Deprecated - Suspicious PrintSpooler Service Executable File Creation

  1[metadata]
  2creation_date = "2020/08/14"
  3deprecation_date = "2026/08/19"
  4deprecated_reason = "This rule is not recommended for use because its heuristic is prone to false positives and is not a strong indicator of Print Spooler exploitation."
  5integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
  6maturity = "deprecated"
  7updated_date = "2026/08/19"
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12Detects attempts to exploit privilege escalation vulnerabilities related to the Print Spooler service. For more
 13information refer to the following CVE's - CVE-2020-1048, CVE-2020-1337 and CVE-2020-1300 and verify that the impacted
 14system is patched.
 15"""
 16from = "now-9m"
 17index = [
 18    "winlogbeat-*",
 19    "logs-endpoint.events.file-*",
 20    "logs-windows.sysmon_operational-*",
 21    "endgame-*",
 22    "logs-m365_defender.event-*",
 23    "logs-sentinel_one_cloud_funnel.*",
 24]
 25language = "kuery"
 26license = "Elastic License v2"
 27name = "Deprecated - Suspicious PrintSpooler Service Executable File Creation"
 28note = """## Triage and analysis
 29
 30> **Disclaimer**:
 31> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 32
 33### Investigating Deprecated - Suspicious PrintSpooler Service Executable File Creation
 34
 35The Print Spooler service in Windows manages print jobs, but vulnerabilities like CVE-2020-1048 can be exploited for privilege escalation. Adversaries may create malicious DLL files executed by the spooler to gain elevated privileges. The detection rule identifies such threats by monitoring file creation events linked to the spooler process, focusing on DLL files, which are common vectors for exploitation.
 36
 37### Possible investigation steps
 38
 39- Review the alert details to confirm the presence of a file creation event with the extension "dll" associated with the "spoolsv.exe" process on a Windows host.
 40- Check the file path and name of the created DLL to determine if it matches known malicious patterns or locations typically used for exploitation.
 41- Investigate the source of the spoolsv.exe process by examining the parent process and any associated user accounts to identify potential unauthorized access or activity.
 42- Analyze recent system logs and security events for any other suspicious activities or anomalies around the time of the DLL creation, such as unexpected user logins or privilege changes.
 43- Verify the patch status of the affected system against the vulnerabilities CVE-2020-1048, CVE-2020-1337, and CVE-2020-1300 to ensure it is up to date and not susceptible to known exploits.
 44- If the DLL is confirmed to be malicious, isolate the affected system to prevent further exploitation and begin remediation efforts, including removing the malicious file and any associated threats.
 45
 46### False positive analysis
 47
 48- Legitimate DLL updates by trusted software can trigger the rule. Users should verify the source of the DLL and, if confirmed safe, add the software's update process to an exception list.
 49- System maintenance activities, such as Windows updates, may create DLLs that match the rule's criteria. Users can exclude these activities by identifying the associated update processes and adding them to the exception list.
 50- Custom in-house applications that interact with the Print Spooler service might generate DLLs during normal operation. Users should validate these applications and exclude their file creation events if they are deemed non-threatening.
 51- Security software or monitoring tools that interact with the Print Spooler service could inadvertently create DLLs. Users should confirm the legitimacy of these tools and configure exceptions for their operations.
 52
 53### Response and remediation
 54
 55- Immediately isolate the affected system from the network to prevent further exploitation or lateral movement by the adversary.
 56- Terminate the spoolsv.exe process if it is confirmed to be executing a malicious DLL, to halt any ongoing malicious activity.
 57- Remove the malicious DLL file from the system to prevent re-execution and further exploitation.
 58- Apply the latest security patches and updates to the affected system, specifically addressing CVE-2020-1048, CVE-2020-1337, and CVE-2020-1300, to close the vulnerabilities exploited by the adversary.
 59- Conduct a thorough review of user accounts and privileges on the affected system to ensure no unauthorized privilege escalation has occurred.
 60- Monitor the network for any signs of similar exploitation attempts or related suspicious activity, using enhanced logging and alerting mechanisms.
 61- Report the incident to the appropriate internal security team or external authorities if required, providing details of the exploit and actions taken for further investigation and response."""
 62references = [
 63    "https://voidsec.com/cve-2020-1337-printdemon-is-dead-long-live-printdemon/",
 64    "https://www.thezdi.com/blog/2020/7/8/cve-2020-1300-remote-code-execution-through-microsoft-windows-cab-files",
 65]
 66risk_score = 21
 67rule_id = "5bb4a95d-5a08-48eb-80db-4c3a63ec78a8"
 68severity = "low"
 69tags = [
 70    "Domain: Endpoint",
 71    "OS: Windows",
 72    "Use Case: Threat Detection",
 73    "Tactic: Privilege Escalation",
 74    "Data Source: Elastic Endgame",
 75    "Use Case: Vulnerability",
 76    "Data Source: Elastic Defend",
 77    "Data Source: Sysmon",
 78    "Data Source: Microsoft Defender XDR",
 79    "Data Source: SentinelOne",
 80    "Resources: Investigation Guide",
 81]
 82timestamp_override = "event.ingested"
 83type = "new_terms"
 84
 85query = '''
 86event.category : "file" and host.os.type : "windows" and event.type : "creation" and
 87  process.name : "spoolsv.exe" and file.extension : "dll"
 88'''
 89
 90setup = """## Setup
 91
 92This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
 93
 94Setup instructions: https://ela.st/install-elastic-defend
 95
 96### Additional data sources
 97
 98This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
 99
100- [Microsoft Defender XDR](https://ela.st/m365-defender)
101- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
102- [Sysmon Event ID 11 - File Create](https://ela.st/sysmon-event-11-setup)
103"""
104
105
106[[rule.filters]]
107[rule.filters.meta]
108negate = false
109[rule.filters.query.wildcard."file.path"]
110case_insensitive = true
111value = "?:\\\\Windows\\\\Sys?????\\\\*"
112
113[[rule.filters]]
114[rule.filters.meta]
115negate = true
116[rule.filters.query.wildcard."file.path"]
117case_insensitive = true
118value = "?:\\\\Windows\\\\Sys?????\\\\PrintConfig.dll"
119
120[[rule.filters]]
121[rule.filters.meta]
122negate = true
123[rule.filters.query.wildcard."file.path"]
124case_insensitive = true
125value = "?:\\\\Windows\\\\Sys?????\\\\x5lrs.dll"
126
127[[rule.filters]]
128[rule.filters.meta]
129negate = true
130[rule.filters.query.wildcard."file.path"]
131case_insensitive = true
132value = "?:\\\\Windows\\\\system32\\\\spool\\\\DRIVERS\\\\x64\\\\*.dll"
133
134[[rule.filters]]
135[rule.filters.meta]
136negate = true
137[rule.filters.query.wildcard."file.path"]
138case_insensitive = true
139value = "?:\\\\Windows\\\\system32\\\\spool\\\\DRIVERS\\\\W32X86\\\\*.dll"
140
141[[rule.filters]]
142[rule.filters.meta]
143negate = true
144[rule.filters.query.wildcard."file.path"]
145case_insensitive = true
146value = "?:\\\\Windows\\\\system32\\\\spool\\\\PRTPROCS\\\\x64\\\\*.dll"
147
148[[rule.filters]]
149[rule.filters.meta]
150negate = true
151[rule.filters.query.wildcard."file.path"]
152case_insensitive = true
153value = "?:\\\\Windows\\\\system32\\\\spool\\\\{????????-????-????-????-????????????}\\\\*.dll"
154
155
156[[rule.threat]]
157framework = "MITRE ATT&CK"
158
159[[rule.threat.technique]]
160id = "T1068"
161name = "Exploitation for Privilege Escalation"
162reference = "https://attack.mitre.org/techniques/T1068/"
163
164[[rule.threat.technique]]
165id = "T1574"
166name = "Hijack Execution Flow"
167reference = "https://attack.mitre.org/techniques/T1574/"
168
169[[rule.threat.technique.subtechnique]]
170id = "T1574.001"
171name = "DLL"
172reference = "https://attack.mitre.org/techniques/T1574/001/"
173
174[rule.threat.tactic]
175id = "TA0004"
176name = "Privilege Escalation"
177reference = "https://attack.mitre.org/tactics/TA0004/"
178[rule.new_terms]
179field = "new_terms_fields"
180value = ["host.id", "file.name"]
181[[rule.new_terms.history_window_start]]
182field = "history_window_start"
183value = "now-5d"