Date: 09/16/2024
Severity: Medium
Summary
The "Windows Spooler Service Suspicious Binary Load" refers to a security concern where the Windows Print Spooler service, which manages print jobs, is exploited to load potentially malicious binaries. Attackers may use this vulnerability to execute unauthorized code or gain elevated privileges on the system. This issue is significant because it can compromise system integrity and data security. Ensuring that the Print Spooler service is properly configured and regularly updated can help mitigate these risks.
Indicators of Compromise (IOC) List
Image | '\spoolsv.exe' |
ImageLoaded | '\Windows\System32\spool\drivers\x64\3\' '\Windows\System32\spool\drivers\x64\4\' '.dll' |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 | ((resourcename in ("Sysmon") AND eventtype = "1") AND image = "\spoolsv.exe") AND imageloaded in ("\Windows\System32\spool\drivers\x64\3","\Windows\System32\spool\drivers\x64\4",".dll") |
Detection Query 2 | ((technologygroup = "EDR") AND image = "\spoolsv.exe") AND imageloaded in ("\Windows\System32\spool\drivers\x64\3","\Windows\System32\spool\drivers\x64\4",".dll") |
Reference:
https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_spoolsv_dll_load.yml