Suspicious NTLM Authentication on the Printer Spooler Service

Title: Suspicious NTLM Authentication on the Printer Spooler Service
Status: test
Description:Detects a privilege elevation attempt by coercing NTLM authentication on the Printer Spooler service
References:
  -https://twitter.com/med0x2e/status/1520402518685200384
  -https://github.com/elastic/detection-rules/blob/dd224fb3f81d0b4bf8593c5f02a029d647ba2b2d/rules/windows/credential_access_relay_ntlm_auth_via_http_spoolss.toml
Author: Elastic (idea), Tobias Michalski (Nextron Systems)
Date: 2022-05-04
modified:2023-02-09
Tags:

• -'attack.privilege-escalation'
• -'attack.credential-access'
• -'attack.t1212'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\rundll32.exe' OriginalFileName:'RUNDLL32.EXE'   selection_cli:
    CommandLine|contains|all:
      -'C:\windows\system32\davclnt.dll,DavSetCookie'
      -'http'

    CommandLine|contains:
      -'spoolss'
      -'srvsvc'
      -'/print/pipe/'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: high