Print Processor Registration

BIOC Low

Print Processor Registration

Adversaries may abuse print processors to run malicious DLLs during system boot that will be executed as SYSTEM for privilege escalation and/or persistence.

Module:: Platform Analytics
Agent event type:: Registry
Category:: Persistence
Status:: Enabled

ATT&CK tactics: Persistence (TA0003)

ATT&CK techniques: Boot or Logon Autostart Execution: Print Processors (T1547.012)

Indicator:

Registry action type = create_registry_key , set_registry_value AND registry data = *.dll AND registry key name = HKEY_LOCAL_MACHINE\SYSTEM\*ControlSet*\Control\Print\Environments\Windows x64\Print Processors Host host os = windows

Preventable: yes