Suspicious DLLs in spool folder

id: cabb3aa3-cbfa-4359-9464-a3093d8b44f3
name: Suspicious DLLs in spool folder
description: |
  Look for the creation of suspicious DLL files spawned in the \spool\ folder along with DLLs that were recently loaded afterwards from \Old.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceFileEvents
  - DeviceImageLoadEvents
tactics:
- Privilege escalation
- Exploit
query: |
  DeviceFileEvents
  | where FolderPath contains @"\system32\spool\drivers\x64\3\"
  | where FileName endswith ".dll"
  | where ActionType in ("FileCreated", "FileRenamed")
  | join kind=inner DeviceImageLoadEvents on DeviceId,DeviceName,FileName,InitiatingProcessFileName
  | where Timestamp1 >= Timestamp and FolderPath1 contains @"\system32\spool\drivers\x64\3\Old"