Cross-source coverage

T1547.010 / ATT&CK

Boot or Logon Autostart Execution: Port Monitors

7 rules across 4 sources.

From MITRE ATT&CK 19.2

Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup. This DLL can be located in C:\Windows\System32 and will be loaded and run by the print spooler service, spoolsv.exe, under SYSTEM level permissions on boot.

Alternatively, an arbitrary DLL can be loaded if permissions allow writing a fully-qualified pathname for that DLL to the Driver value of an existing or new arbitrarily named subkey of HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors. The Registry key contains entries for the following:

  • Local Port
  • Standard TCP/IP Port
  • USB Monitor
  • WSD Port
Platforms
Windows
Telemetry
WinEventLog:SysmonWinEventLog:Application

How MITRE says to detect it DET0204

Detection Strategy for T1547.010 – Port Monitor DLL Persistence via spoolsv.exe (Windows)

Windows Analytic 0580

Detects suspicious registry modifications under `HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\*\Driver`, DLL loads by `spoolsv.exe` of non-standard or unsigned modules, and abnormal usage of the `AddMonitor` API by non-installation processes. This pattern often indicates an attempt to persist a malicious DLL via the print monitor mechanism, particularly when correlated with creation of files in `C:\Windows\System32` not tied to known patches or installations.

  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:Sysmon EventCode=7
  • WinEventLog:Sysmon EventCode=13
  • WinEventLog:Sysmon EventCode=11
  • WinEventLog:Application API call to AddMonitor invoked by non-installer process

View on attack.mitre.org ↗

SigmaHQ/sigma

4 rules
Detection Severity Format
Bypass UAC Using Event Viewer High Sigma
Default RDP Port Changed to Non Standard Port High Sigma
Add Port Monitor Persistence in Registry Medium Sigma
Potential Suspicious Activity Using SeCEdit Medium Sigma

chronicle/detection-rules

1 rule
Detection Severity Format
default_rdp_port_changed_to_non_standard_port High YARA-L

elastic/detection-rules

1 rule
Detection Severity Format
Potential Port Monitor or Print Processor Registration Abuse Medium Elastic TOML

splunk/security_content

1 rule
Detection Severity Format
Monitor Registry Keys for Print Monitors Undefined SPL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.