Suspicious Spoolsv Child Process

id: ece67992-9699-44f5-a5c5-f7e5c2d1d5d4
name: Suspicious Spoolsv Child Process
description: |
  Surfaces suspicious spoolsv.exe behavior likely related to CVE-2021-1675
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceImageLoadEvents
  - DeviceProcessEvents
tactics:
- Privilege escalation
- Exploit
query: |
  // Look for file load events for spoolsv
  DeviceImageLoadEvents
  | where Timestamp > ago(7d)
  | where InitiatingProcessFileName =~ "spoolsv.exe"
  | where FolderPath has @"spool\drivers"
  | extend LoadFileTime = Timestamp
  | distinct DeviceId, LoadFileTime, FileName, SHA256
  // Join process data associated with spoolsv launching suspicious processes after image load
  | join DeviceProcessEvents on $left.DeviceId == $right.DeviceId
  | where Timestamp > ago(7d)
  | where Timestamp < LoadFileTime +5m
  | where InitiatingProcessFileName =~ "spoolsv.exe"
  | where ProcessIntegrityLevel =~ 'SYSTEM'
  | where (FileName1 in~("gpupdate.exe", "whoami.exe", "nltest.exe", "taskkill.exe",
              "wmic.exe", "taskmgr.exe", "sc.exe", "findstr.exe", "curl.exe", "wget.exe", "certutil.exe", "bitsadmin.exe", "accesschk.exe",
              "wevtutil.exe", "bcdedit.exe", "fsutil.exe", "cipher.exe", "schtasks.exe", "write.exe", "wuauclt.exe") or 
  // Processes with specific FPs removed          
  (FileName1 =~ "net.exe" and ProcessCommandLine !has "start") or 
  (FileName1 =~ "cmd.exe" and not(ProcessCommandLine has_any(".spl", "route add", "program files"))) or 
  (FileName1 =~ "netsh.exe" and not(ProcessCommandLine has_any("add portopening", "rule name")))) or
  (FileName1 =~ "powershell.exe" and ProcessCommandLine!has ".spl") or
  (FileName1 =~ "rundll32.exe" and ProcessCommandLine != "" and ProcessCommandLine !contains " ")