SMB Spoolss Name Piped Usage


Description

Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.

Query · sigma

selection:
  path|endswith: IPC$
  name: spoolss
condition: selection

Known false positives

  • Domain Controllers that are sometimes, commonly although should not be, acting as printer servers too
Raw source SMB Spoolss Name Piped Usage · Sigma
Esc
Published by SigmaHQ/sigma ↗, licensed under Detection Rule License 1.1 ↗. Reproduced here unmodified.
title: SMB Spoolss Name Piped Usage
id: bae2865c-5565-470d-b505-9496c87d0c30
status: test
description: Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.
references:
    - https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1
    - https://dirkjanm.io/a-different-way-of-abusing-zerologon/
    - https://twitter.com/_dirkjan/status/1309214379003588608
author: OTR (Open Threat Research), @neu5ron
date: 2018-11-28
modified: 2022-10-09
tags:
    - attack.lateral-movement
    - attack.t1021.002
logsource:
    product: zeek
    service: smb_files
detection:
    selection:
        path|endswith: 'IPC$'
        name: spoolss
    condition: selection
falsepositives:
    - Domain Controllers that are sometimes, commonly although should not be, acting as printer servers too
level: medium

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.