Vuln: CVE-2020-1048 | Detection.FYI

Suspicious Print Spooler SPL File Created

Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Privilege Escalation Resources: Investigation Guide Data Source: Elastic Endgame Use Case: Vulnerability Data Source: Elastic Defend Data Source: Microsoft Defender XDR Noise: Medium Performance: Normal Threat: Vulnerability Exploit Rule Type: Event Correlation (EQL) Platform: Windows Resources: Osquery Vuln: CVE-2020-1048 Vuln: CVE-2020-1337 ·
Share on:

Detects attempts to exploit privilege escalation vulnerabilities related to the Print Spooler service including CVE-2020-1048 and CVE-2020-1337.

Read More