Detection rules › Splunk

Spoolsv Writing a DLL

Author
Mauricio Velazco, Michael Haag, Splunk
Source
upstream

The following analytic detects spoolsv.exe writing a .dll file, which is unusual behavior and may indicate exploitation of vulnerabilities like CVE-2021-34527 (PrintNightmare). This detection leverages the Endpoint datamodel, specifically monitoring process and filesystem events to identify .dll file creation within the \spool\drivers\x64\ path. This activity is significant as it may signify an attacker attempting to execute malicious code via the Print Spooler service. If confirmed malicious, this could lead to unauthorized code execution and potential system compromise. Immediate endpoint isolation and further investigation are recommended.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1547.012 Boot or Logon Autostart Execution: Print Processors
Privilege EscalationT1547.012 Boot or Logon Autostart Execution: Print Processors

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation
Sysmon11FileCreate
Security-Auditing4688A new process has been created.

Stages and Predicates

Stage 1: tstats

tstats WHERE Processes.process_name="spoolsv.exe" BY _time, Processes.action, Processes.dest, Processes.original_file_name, Processes.parent_process, Processes.parent_process_exec, Processes.parent_process_guid, Processes.parent_process_id, Processes.parent_process_name, Processes.parent_process_path, Processes.process, Processes.process_exec, Processes.process_guid, Processes.process_hash, Processes.process_id, Processes.process_integrity_level, Processes.process_name, Processes.process_path, Processes.user, Processes.user_id, Processes.vendor_product

Stage 2: search

search

Stage 3: join

join type=inner (...)

Stage 4: dedup

dedup file_create_time

Stage 5: table

table dest, file_create_time, file_name, file_path, process_guid, process_name

Stage 6: search

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Filesystem.file_nameeq
  • "*.dll" corpus 3 (splunk 3)
Filesystem.file_patheq
  • "*\\spool\\drivers\\x64\\*" corpus 2 (splunk 2)
Processes.process_nameeq
  • spoolsv.exe corpus 2 (splunk 2)