Print spooler set to load new DLL on boot

BIOC Informational

Print spooler set to load new DLL on boot

Malware can use this technique to load malicious code at startup that will persist on system reboot. This DLL must be located in C:\Windows\System32 and will be loaded by the print spooler service, spoolsv.exe, on boot. A port monitor can be set through the AddMonitor API.

Module:: Platform Analytics
Agent event type:: Registry
Category:: Persistence
Status:: Enabled

ATT&CK tactics: Persistence (TA0003)

ATT&CK techniques: Boot or Logon Autostart Execution: Port Monitors (T1547.010)

Indicator:

Registry action type = set_registry_value , create_registry_key AND registry data != BPSLMONITOR.DLL AND registry key name = *Control\Print\Monitors* AND registry value name = driver Host host os = windows

Preventable: yes