Skip to content
This repository was archived by the owner on Nov 16, 2023. It is now read-only.

Update Suspicious Spoolsv Child Process.md #373

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Update Suspicious Spoolsv Child Process.md #373

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion Exploits/Print Spooler RCE/Suspicious Spoolsv Child Process.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,8 @@ DeviceImageLoadEvents
(FileName =~ "net.exe" and ProcessCommandLine !has "start") or
(FileName =~ "cmd.exe" and not(ProcessCommandLine has_any(".spl", "route add", "program files"))) or
(FileName =~ "netsh.exe" and not(ProcessCommandLine has_any("add portopening", "rule name")))) or
(FileName =~ "powershell.exe" and ProcessCommandLine!has ".spl")
(FileName =~ "powershell.exe" and ProcessCommandLine!has ".spl") or
(FileName =~ "rundll32.exe" and ProcessCommandLine != "" and ProcessCommandLine !contains " ")
```
## Category
This query can be used to detect the following attack techniques and tactics ([see MITRE ATT&CK framework](https://attack.mitre.org/)) or security configuration states.
Expand Down