DLL file created by printer spool service, possible malware binary drop from PrintNightmare exploit

Description

No license declared

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

1. 92206 DLL file created by printer spool service, possible malware binary drop from PrintNightmare exploit anchor level 12
   field win.eventdata.image="\\spoolsv.exe$" AND field win.eventdata.targetFilename="(?i)[c-z]:\\\\Windows\\\\System32\\\\spool\\\\drivers.+\.dll"
2. 900097 DLL file created by printer spool service, possible malware binary drop from PrintNightmare exploit exclusion level 10 this rule
   Matches no fields of its own.

Rule dependencies

Depends on

• composes · Wazuh if_sid 92206
  • DLL file created by printer spool service, possible malware binary drop from PrintNightmare exploit