Windows Spooler Service Suspicious Binary Load

calendar Nov 10, 2025 · attack.persistence attack.defense-evasion attack.privilege-escalation attack.t1574 cve.2021-1675 cve.2021-34527 detection.emerging-threats  ·
Share on: linkedin copy

Detect DLL Load from Spooler Service backup folder. This behavior has been observed during the exploitation of the Print Spooler Vulnerability CVE-2021-1675 and CVE-2021-34527 (PrinterNightmare).

Sigma rule (View on GitHub)

 1title: Windows Spooler Service Suspicious Binary Load
 2id: 02fb90de-c321-4e63-a6b9-25f4b03dfd14
 3status: test
 4description: |
 5        Detect DLL Load from Spooler Service backup folder. This behavior has been observed during the exploitation of the Print Spooler Vulnerability CVE-2021-1675 and CVE-2021-34527 (PrinterNightmare).
 6references:
 7    - https://web.archive.org/web/20210629055600/https://github.com/hhlxf/PrintNightmare/
 8    - https://github.com/ly4k/SpoolFool
 9author: FPT.EagleEye, Thomas Patzke (improvements)
10date: 2021-06-29
11modified: 2022-06-02
12tags:
13    - attack.persistence
14    - attack.defense-evasion
15    - attack.privilege-escalation
16    - attack.t1574
17    - cve.2021-1675
18    - cve.2021-34527
19    - detection.emerging-threats
20logsource:
21    category: image_load
22    product: windows
23detection:
24    selection:
25        Image|endswith: '\spoolsv.exe'
26        ImageLoaded|contains:
27            - '\Windows\System32\spool\drivers\x64\3\'
28            - '\Windows\System32\spool\drivers\x64\4\'
29        ImageLoaded|endswith: '.dll'
30    condition: selection
31falsepositives:
32    - Loading of legitimate driver
33level: informational

References

Related rules

to-top