MITRE ATT&CK technique · Persistence, Privilege Escalation

`T1547.012` Print Processors

Sub-technique of T1547 Boot or Logon Autostart Execution

Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation. Print processors are DLLs that are loaded by the print spooler service, `spoolsv.exe`, during boot.(Citation: Microsoft Intro Print Processors) Adversaries may abuse the print spooler service by adding print processors that load malicious DLLs at startup. A print processor…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

Earth Lusca

Sigma rules to hunt it

SigmaHQ has no rules for this technique.

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.